27 ms·

Turning the JZ into a nop to fallthrough to the next line is easier, right? That might be what he did in the quickfix area anyway. The self-marriage part was p

Turning the JZ into a nop to fallthrough to the next line is easier, right? That might be what he did in the quickfix area anyway. The self-marriage part was pretty hilarious. "Do I take myself? I do!"

skissane 6y ago
> The self-marriage part was pretty hilarious. "Do I take myself? I do!" People are doing that in real life: https://www.abc.net.au/everyday/why-women-marry-themselves/11733546 https://www.abc.net.au/everyday/why-women-marry-themselves/1... Of course, it isn't legally recognised anywhere. And I doubt it will be – marriage as a legal relationship between two distinct people has various legal consequences on property law, taxation law, etc – a self-married person is legally indistinguishable from an unmarried person. But no law against holding a party called a "self-marriage ceremony", if your guests are happy to attend it.
- bregma 6y ago
  There is a very big difference between a wedding and a marriage. I don't understand why this confuses so many people, but it does.
  - occamrazor 6y ago
    In some languages the same word means both, e.g. the Italian “matrimonio”
    - valarauko 6y ago
      Come to think of it, it seems to be the case in at least some Indian languages (ie, "wedding" & "marriage" are referred to by the same term). I can't think of a distinct native term for "marriage" as an entity or a state of being - the closest I can come up with is akin to "married" as a past tense verb.
    - pseudalopex 6y ago
      English has wedlock.
29athrowaway 6y ago
This technique is known as a NOP sled. You have to change all the bytes in the jump to NOPs (opcode 0x90). https://en.wikipedia.org/wiki/NOP_slide https://en.wikipedia.org/wiki/NOP_slide
- ashkankiani 6y ago
  I may have used that technique once or twice in Ollydbg before, but I didn't realize it had a name. Thanks for that.
  - 29athrowaway 6y ago
    OllyDbg has been discontinued but now you can use one of its spiritual successors: - https://github.com/eteran/edb-debugger https://github.com/eteran/edb-debugger - https://x64dbg.com/ https://x64dbg.com/ Other tools you might like... - https://cutter.re/ https://cutter.re/ - https://github.com/longld/peda https://github.com/longld/peda - https://github.com/Gallopsled/pwntools https://github.com/Gallopsled/pwntools And of course, Ghidra, that means no mention.
- _Microft 6y ago
  A NOP slide is a slightly different thing. The NOPs as suggested by GP are meant to replace unwanted instructions. The purpose of a NOP slide is to serve as target area for jumps and to guide the flow of execution to a particular adress at the end of the slide, independent of where in the NOPed range a jump was actually executed to.
HelloNurse 6y ago
Changing JZ into JZ to the following address has the advantage of ease of editing: same length, same opcode, reliably copied, pasted and inspected value. A NOP sequence is more general but making it the wrong length is not impossible.
- junon 6y ago
  NOP on x86 is one byte. Patching out an instruction with a NOP is always possible. Further, not all jumps are equal; while you can certainly patch the assembly and let the assembler manage the variant selection and relocations etc., doing bytecode patching is a different story. You might have to change the jump instruction altogether depending on how "far" away the pointer is. Also, jumps hold conditions in most cases (the exception being an unconditional jump, JMP) which means that you have to adhere to whatever state is expected at that point in time. The NOP approach is usually the soundest and safest.
  - HelloNurse 6y ago
    It's more general, but also more invasive. Replacing jumps with another jump as discussed in the article leaves part of the original intent (the test or the address) intact, while a NOP sequence leaves no indication of what it replaces.

skissane 6y ago

> The self-marriage part was pretty hilarious. "Do I take myself? I do!" People are doing that in real life: https://www.abc.net.au/everyday/why-women-marry-themselves/11733546 https://www.abc.net.au/everyday/why-women-marry-themselves/1... Of course, it isn't legally recognised anywhere. And I doubt it will be – marriage as a legal relationship between two distinct people has various legal consequences on property law, taxation law, etc – a self-married person is legally indistinguishable from an unmarried person. But no law against holding a party called a "self-marriage ceremony", if your guests are happy to attend it.

bregma 6y ago
There is a very big difference between a wedding and a marriage. I don't understand why this confuses so many people, but it does.
- occamrazor 6y ago
  In some languages the same word means both, e.g. the Italian “matrimonio”
  - valarauko 6y ago
    Come to think of it, it seems to be the case in at least some Indian languages (ie, "wedding" & "marriage" are referred to by the same term). I can't think of a distinct native term for "marriage" as an entity or a state of being - the closest I can come up with is akin to "married" as a past tense verb.
  - pseudalopex 6y ago
    English has wedlock.

29athrowaway 6y ago

This technique is known as a NOP sled. You have to change all the bytes in the jump to NOPs (opcode 0x90). https://en.wikipedia.org/wiki/NOP_slide https://en.wikipedia.org/wiki/NOP_slide

ashkankiani 6y ago
I may have used that technique once or twice in Ollydbg before, but I didn't realize it had a name. Thanks for that.
- 29athrowaway 6y ago
  OllyDbg has been discontinued but now you can use one of its spiritual successors: - https://github.com/eteran/edb-debugger https://github.com/eteran/edb-debugger - https://x64dbg.com/ https://x64dbg.com/ Other tools you might like... - https://cutter.re/ https://cutter.re/ - https://github.com/longld/peda https://github.com/longld/peda - https://github.com/Gallopsled/pwntools https://github.com/Gallopsled/pwntools And of course, Ghidra, that means no mention.
_Microft 6y ago
A NOP slide is a slightly different thing. The NOPs as suggested by GP are meant to replace unwanted instructions. The purpose of a NOP slide is to serve as target area for jumps and to guide the flow of execution to a particular adress at the end of the slide, independent of where in the NOPed range a jump was actually executed to.

HelloNurse 6y ago

Changing JZ into JZ to the following address has the advantage of ease of editing: same length, same opcode, reliably copied, pasted and inspected value. A NOP sequence is more general but making it the wrong length is not impossible.

junon 6y ago
NOP on x86 is one byte. Patching out an instruction with a NOP is always possible. Further, not all jumps are equal; while you can certainly patch the assembly and let the assembler manage the variant selection and relocations etc., doing bytecode patching is a different story. You might have to change the jump instruction altogether depending on how "far" away the pointer is. Also, jumps hold conditions in most cases (the exception being an unconditional jump, JMP) which means that you have to adhere to whatever state is expected at that point in time. The NOP approach is usually the soundest and safest.
- HelloNurse 6y ago
  It's more general, but also more invasive. Replacing jumps with another jump as discussed in the article leaves part of the original intent (the test or the address) intact, while a NOP sequence leaves no indication of what it replaces.