From 621a1ec64166f0275657d1d7db97b49d85fcfe83 Mon Sep 17 00:00:00 2001 From: gbrochar Date: Tue, 16 Apr 2024 21:25:36 +0200 Subject: [PATCH] fix: jump value hotfix, double injection OK --- gen_payload.sh | 1 + print.s | 4 ++-- srcs/woody.c | 1 + 3 files changed, 4 insertions(+), 2 deletions(-) create mode 100755 gen_payload.sh diff --git a/gen_payload.sh b/gen_payload.sh new file mode 100755 index 0000000..2c99491 --- /dev/null +++ b/gen_payload.sh @@ -0,0 +1 @@ +nasm -f elf64 -o print.o print.s && ld -o print print.o && nasm -f bin -o payload print.s && hexdump -v -e '"\\\x\" 1/1 "%02x"' payload diff --git a/print.s b/print.s index 3a557c8..83e7918 100644 --- a/print.s +++ b/print.s @@ -14,7 +14,7 @@ _start: mov rdi, 1 mov rdi, 1 lea rsi, [rel msg] - mov rdx, 10 + mov rdx, 14 mov rax, 1 syscall @@ -24,4 +24,4 @@ _start: pop rax jmp 0x00000000 - msg db "..WOODY..",10 + msg db "....WOODY....",10 diff --git a/srcs/woody.c b/srcs/woody.c index 94522a1..448a085 100644 --- a/srcs/woody.c +++ b/srcs/woody.c @@ -100,6 +100,7 @@ int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_posi { int32_t jmp_index = ptr - payload->payload; int32_t jump_value = ((payload_position + payload->len) - woody->Ehdr->e_entry) * -1; + jump_value += 14; ft_memcpy(&payload->payload[jmp_index + 1], &jump_value, sizeof(jump_value)); ft_memcpy(woody->file + payload_position, payload->payload, payload->len);