3 ms·
Used the exact same trick when researching dumb ways to break AV signatures at uni :) You can also abuse the displacement math with eiz: ff 34 24 push DWO
by kuroguro 4y ago
Used the exact same trick when researching dumb ways to break AV signatures at uni :)
You can also abuse the displacement math with eiz:
ff 34 24 push DWORD PTR [esp]
ff 34 e4 push DWORD PTR [esp+eiz*8]
Or some useless prefixes may work:
80 c0 53 add al,0x53
36 04 53 ss add al,0x53
- wruza 4y agoThis is the first time I learned about eiz. Cool trick! What’s eiz: https://stackoverflow.com/a/2553556/3125367 https://stackoverflow.com/a/2553556/3125367
- ginnungagap 4y agoIf I remember correctly there are also tricks like lea rax, [eiz+rbx*4] instead of lea rax, [rbx*4] because the latter will produce an heavier binary by being interpreted as lea rax, [00000000h+rbx*4]
- rep_lodsb 4y agoYou won't find "eiz" in any Intel manual, and NASM doesn't recognize it either. x86 has no zero register¹. This appears to be some GNU-specific syntax meaning "encode SIB byte with no index register". The only case where this would be required by the hardware is when using ESP/RSP as a base register, and every assembler should produce the correct encoding for that if you simply write [ESP]. So using "eiz" on GAS lets you control what is put into the (unused) scale field. One might call that a feature, but it is a meaningless encoding detail similar to which variant of "register to register" opcodes is emitted, something that I don't think any assembler gives you control over. ¹ except maybe on the microarchitectural level, but that isn't visible to the programmer