5 ms·
> Conditional control flow is possible thanks to this gem of an instruction: ff242500004000 jmp qword [0x400000] How is this "conditional"? The
by thamer 4y ago
> Conditional control flow is possible thanks to this gem of an instruction:
ff242500004000 jmp qword [0x400000]
How is this "conditional"? The article explains that it simply "jumps to whatever address is stored as a 64-bit quantity at address 0x400000", but where's the condition here?
- jstanley 4y agoI'm guessing: Create a 2-element array of branch targets. Compute a boolean condition function (0 or 1). Index into the 2-element array with this 0 or 1 value and write it into 0x400000, then jmp qword [0x400000].
- monocasa 4y agoOr know the difference between the addresses of the true pathway and the false pathway, multiply your 0 or 1 result by that difference and add that to whichever pathway's base is lower. No lookup table needed.
- monocasa 4y agoBecause by being indirect, you can change the jump target in 0x400000 via the result of alu ops.
- hinkley 4y agoEveryone is finding a roundabout way to say “self modifying code”
- monocasa 4y agoNo self modifying code needed, simply embracing pointer arithmetic more than is typically allowed without your sanity being brought into question. This technique works just fine with no changes to page permissions and W^X.