Log in

View Full Version : same codebytes, different meaning ?!


0rp
April 3rd, 2004, 18:23
if i compile this function

Code:

void foo()
{
printf("bar\n";
}



the compiler produces this:
Code:

00401090 55 push ebp
00401091 8B EC mov ebp,esp
00401093 68 10 71 40 00 push 407110h <--- "bar\n"
00401098 E8 73 01 00 00 call 00401210 <-- printf
0040109D 83 C4 04 add esp,4
004010A0 5D pop ebp
004010A1 C3 ret



if VirtualAlloc new memory, and cpy all this codebytes to this memory (55, 8B, EC, ... C3), the debugger shows this:

Code:

00340000 55 push ebp
00340001 8B EC mov ebp,esp
00340003 68 10 71 40 00 push 407110h
00340008 E8 73 01 00 00 call 00340180 <---- wtf?
0034000D 83 C4 04 add esp,4
00340010 5D pop ebp
00340011 C3 ret


my question: why does the call gets 00340180 and not 00401210 ?

doug
April 3rd, 2004, 18:41
note that the printf function has been injected into your code (that's ok).

now, if you look carefully, the instruction used to call printf uses EIP-relative addressing.
Code:

00401098 E8 73 01 00 00 call 00401210 <-- printf
0040109D 83 C4 04 add esp,4

the destination (401210) is calculated as follows:
-> 40109D (next instruction) + 173 = 401210

in your valloc'd code:
Code:

00340008 E8 73 01 00 00 call 00340180 <---- wtf?
0034000D 83 C4 04 add esp,4

-> 34000D + 173 = 340180.

there are many workarounds for this.
Ex: Patch the dword after E8 with (00401210 - 34000D = C1203). You can compute these offsets at runtime.

0rp
April 3rd, 2004, 18:42
ah EIP relative, ok
thx