Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- // this is the function I'm trying to jump to
- 0x40102e <lit> lods %ds:(%rsi),%rax
- 0x401030 <lit+2> push %rax
- 0x401031 <lit+3> lods %ds:(%rsi),%rax
- 0x401033 <lit+5> jmpq *%rax
- // this is where we're executing from
- 0x401035 <hello_world> push %rsi
- // %rax is equal to 0x401035, I checked.
- // %rax now loads from 0x401043, I checked the math too.
- 0x401036 <hello_world+1> mov 0xe(%rax),%rax
- 0x40103a <hello_world+5> lea 0xa(%rip),%rsi # 0x40104b <hello_world+22>0x401041 <hello_world+12>
- // the rsi trick seems to load the correct address
- (gdb) info reg rsi
- rsi 0x40104b 4198475
- // segfault
- jmpq *%rax
- // this is the beginning of the data, which is an array of 64-bit pointers.
- // %rax is supposed to point at 0x40102e, i.e. <lit>, but instead it points at garbage.
- (gdb) p/x *(long*) 0x401043
- $4 = 0x680040102e
- // and I can confirm that %rax equals the same.
- // as we can see, 0x401043 is actually equal to
- // 0x000000680040102e instead of
- // ^ why is this here?
- // 0x000000000040102e
- // this data was generated with
- <code>
- .long lit
- .long 'h'
- <...>
- 0x401043 <hello_world+14> adc %al,%cs:0x0(%rax)
- 0x401047 <hello_world+18> pushq $0x5000000
- 0x40104c <hello_world+23> adc %al,0x0(%rax)
- 0x40104f <hello_world+26> adc %al,%cs:0x0(%rax)
- 0x401053 <hello_world+30> insb (%dx),%es:(%rdi)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement