4 ms·
Using ARM Inline Assembly and Naked Functions to Fool Disassemblers
- userbinator 11y agoThat's a bit surprising (particularly the IDA case), and probably an indication that the ARM code/data separator in these disassemblers needs some work... because my experience with x86 IDA is that it is not going to think some address is the start of a function and disassemble it unless it actually finds a control flow instruction like call/jump leading to it, and it starts at the entry point when it does code/data separation so it shouldn't falsely identify data as code (indirect jumps, however, do tend to make it stumble, so code that doesn't get disassembled is the more common case.) Another possibility could be blind reliance on debug information that's causing it to think that symbol is a function; strip the binary and try again.
- evilsocket 11y agogood point although the post is just a simple PoC ... to fool the kind of behaviour you're talking about, one could simply install a signal handler, call the fake function, handle the sigsegv or whatever, and then use the function as data ... also, since ARM instrutions are 4 bytes each, you could play with 3 bytes declaration ... funny things happen ;)
- kw71 11y agoTerrible javascript on this page, all I see is a Mr Clean lookalike. Not going to bother fiddling to read it. Sorry for the rude comment but I've finally lost it.
- evilsocket 11y agoMr Clean lookalike here :D Do you have any specific navigation problem on the website? i recently switched to a new blog theme, maybe it's that?
- jarman 11y agoWhen js is disabled, fixed-positioned, 100% width, 100% height sidebar takes all page, hiding text
- evilsocket 11y agoi see, well that's the default behaviour ... apparently js is not optional for that theme, im sorry :)
- kw71 11y agoHi thanks for checking in! http://i.imgur.com/wlgowRR.png http://i.imgur.com/wlgowRR.png Can't move. :(
- xenophonf 11y agoI added an ABE rule to hide "evilsocket.net##.cover", which took care of that. Very poor behavior on behalf of the theme developer, if you ask me.
- pjmlp 11y agoAnd so yet another young developer discovers the tricks of the Assembly programming golden age. :)
- evilsocket 11y agomore than 15 yr experience actually, I just thought that sharing some simple tricks would be a good thing
- pjmlp 11y agoSorry about that then, it is just that HN tends to be full of young Web devs rediscovering the ways of old. :) Nice idea though.
- evilsocket 11y agono offence taken at all :D and I totally agree with you, that's why it's so important to share old tricks despite their simplicity :)
- deleted 11y ago[deleted]
- legulere 11y agoBasically what you're doing is marking data as a function in the executable/library metadata.