3 ms·
Note that x86 has variable-length instructions, so incrementing RIP by 10 will not, in general, do what you want it to do. The author basically put in a nop sli
by tonyarkles 6y ago
Note that x86 has variable-length instructions, so incrementing RIP by 10 will not, in general, do what you want it to do. The author basically put in a nop slide[1] to ensure that that would work. Buuuuuut I’m pretty sure you could parse ELF debug symbols and effectively calculate the address of the next logical C instruction to execute :D
Terrifying but fun!
[1] https://en.wikipedia.org/wiki/NOP_slide https://en.wikipedia.org/wiki/NOP_slide
- loeg 6y agoOr decode the x86 stream to find the next instruction. :-) Next C statement is pretty cute, though.
- matja 6y agoInteresting problem - what's the shortest C function that takes a pointer to bytes and returns the length of the x86-64 instruction there? (and how many hours would it take to code it)
- loeg 6y agoStart here and minimize as you see fit: https://intelxed.github.io/ref-manual/group__DEC.html#ga4bef6152f61997a47c4e0fe4327a3254 https://intelxed.github.io/ref-manual/group__DEC.html#ga4bef...
- mhh__ 6y agoThe cheating way is probably to do this https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Breaking-The-x86-ISA.pdf https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Bre... (page ~71) i.e. shift across an instruction boundary.
- kccqzy 6y agoPut it on a page boundary. Make sure the next page isn't accessible. Analyze the resulting page fault.
- nilsb 6y agoOn Error Resume Next
- vsareto 6y agoThat reminds me of the time I saw a C# database save function looking at the stack trace to figure out if it had already been called, exiting if it saw itself on the stack. I mean, it's not wrong, but it is crazy.
- tonyarkles 6y agoIf I recall, I once did something like this in Python that modified variables in its caller. Not for production, just for shits and giggles :D
- loeg 6y agohttps://github.com/ajalt/fuckitpy https://github.com/ajalt/fuckitpy
- aaron_m04 6y agoIs a larger slide and RIP increment needed then? Or can these never be made large enough?
- tonyarkles 6y agoThe reason this worked in this example is because they knew which line would cause the SEGV. In the general case where you're trying to catch arbitrary segfaults, you'd need a slide in between every instruction if you wanted to do a fixed RIP increment. What you really need to do is figure out which instruction was executing and increment RIP appropriately.