4 ms·
Hmm... so after looking at http://ref.x86asm.net/coder32.html http://ref.x86asm.net/coder32.html apparently 0xC2 and 0xC3 are RET. On my 32bit Linux machine, th
by smtddr 13y ago
Hmm... so after looking at http://ref.x86asm.net/coder32.html http://ref.x86asm.net/coder32.html apparently 0xC2 and 0xC3 are RET. On my 32bit Linux machine, the following code printed "Okay! c2 found @ 174" Is this code correct in any way??? I guess the fact that I'm assuming every byte is a whole instruction; not even accounting for the operands is already a problem. But am I even reading the bytes properly at all?
#include <stdio.h>
void rightmeow()
{
int q;
for(q = 0; q < 10 ; q++)
printf("It's new!\n");
return;
}
int main(int argc, char** argv)
{
int i;
unsigned char bytecode;
for(i = 0; i < 9999 ; i++)
{
bytecode = (unsigned char)(**(rightmeow+i));//--- does this really work?
if (bytecode == 0xC2 || bytecode == 0xC3)
break;
}
if( i == 9999)
printf("No good.\n");
else
printf("Okay! %x found @ %d\n",bytecode,i);
return 0;
}
- userbinator 13y agoYou probably mean *(((unsigned char *)rightmeow)+i) but just change the "q < 10" line to "q < 195" and you should see the output change, since that immediate constant is going to be present at least once before the final ret. For me, changing that changes the output from c3 being found at 47 to it being found at 25.
- smtddr 13y agoNice! For me it changed from being found at 38, to 34. I wonder why you get C3 while I get C2.
- userbinator 13y agoC2 is RET iw, i.e. has 16-bit immediate value following the instruction, the # of bytes of parameters to pop from the stack. That should be 0 in this case so it could use C3 and save 2 bytes, but compilers aren't always really intelligent, although this is the first time I've seen that. Then again, it could be something else and not the actual return you found.