4 ms·
Movfuscator [0] (which expands on the paper) managed to find a way to jump using just mov - by using a faulting mov. [0] https://github.com/xoreaxeaxeax/movfus
by shakna 7y ago
Movfuscator [0] (which expands on the paper) managed to find a way to jump using just mov - by using a faulting mov.
[0] https://github.com/xoreaxeaxeax/movfuscator https://github.com/xoreaxeaxeax/movfuscator
- nneonneo 7y agoYeah, I remember this. It requires setting up a custom signal handler though. IIRC something similar is used to get system/library calls (which also can’t be expressed purely with mov instructions, normally). If I recall correctly tom7 had a cute trick to get looping behavior in his ASCII-only compiler for 16-bit Intel (http://tom7.org/abc/ http://tom7.org/abc/) which was to make the program 64KB exactly, such that the program counter just loops around at the end. I suppose that’s another option to get _pure_ mov-only code.