13 hours 15 minutes
Hello. This is Dr Miller in this episode 15.4 of Assembly.
Today, we're gonna right a 64 bit function.
So a 64 bit function.
So what's our problem? To be solved? Well, we're gonna write a function that's going to dump the registers, and it's gonna print out all of the 64 bit registers,
um, that air for general purpose use, and then we're going to use the fast call conventions.
So here I've already started a project. So for this, we can look at the files, so we're going to have our iot dot Include,
So in this, it's saying that we are going to write some functions, so we're going to write the dumper eggs function. And I've already written a couple of other functions,
Um, that we can use
and so inside of i O S. M.
I did take the time to type in this long string here, so this is gonna have registers.
So we got our X, we got the zero X in the front, and then we've got percent.
And then we're saying we want leading zeros. We'd like 16 digits. We're going to do a long hex
for each one of these. And so I've got each
register so r e x r B x r C x rdx
um, I sprinkled a few new lines in here so that we can read it, put a couple of extra new lines here
at the end and then terminated with zero.
And then when we're going to start this, we're gonna start down here in our dump regs function.
So the first thing is to set up our stack, and we're actually going to use the stack quite a bit, because here we don't want to change any of the registers. And so we're gonna have to save
all over registers as we go. So the first thing is, we'll start with our prologue.
So again we have, um,
our for our prefix and that e So we got Rvp, and then we're going to move our
RSP So our stack pointer is that RSP?
Um, the thing at the end rights are epilogue. We're going to to move our S p r b p
and then pop R B p.
So we've got our prologue on our epilogue set up, and we're going to need our BP in order to reference a rvp and be RSP when we get going here.
So at the beginning, we're going to push a bunch of our registers on so that we can restore them when we're done. And I'm gonna put offsets here.
So we got push Rx, and that's at minus eight. So,
um, when we're looking at our e X right, we've got our saved rvp, and then we also have our
we're gonna call this function and so we're gonna have a return address. And so this is at our BP
minus eight, and I'll keep writing references so that we can keep track of them when we're going to use them later.
Some push RB x
push, R c X.
So this is at minus 10. So remember that we're dealing with 64 bit.
And so, um,
we're going to
be at 16 here, and so 16 is 10 in hex
and this is at minus 18. Hicks
type the right letter here.
Bush R D X, and that's at
thing in this. Put my minus there.
Push or s I
That's at minus 30 hex
I don't do our eight.
That's at 38.
Push our nine.
That's it. Minus
And then I'm going to set this up. And what we're going to do here is we're actually going to be pushing on some of the arguments that we're going to use it. The very end. And so we're actually going to do RSP at this point and then rvp and then we'll do. The other are 10 through our 15.
So since I've already saved our eight,
I can move into our eight
r b p,
and then I can add to our eight r b
10 hex. So the reason that I'm gonna add 10 hex. So I have,
um, eight for the pushed on version of our BP.
And then I have eight for the return address. And so I want to get the stack here at this point.
So I have to add 16 or 10 and hex.
And now I can push on
are eight, and this is going to represent RSP
now. I also want to do rvp, So move
the value at our BP.
So that would give me my old Rvp because Rvp points to its old version of itself.
So it off said zero, and then I can push our eight.
Now, the reason why I did this is I'm actually going to use these these air at the very end. If we look here, we got Rvp and RSP,
so I'm going to do them backwards because that'll be the easiest way to do it. So then I need to go through our 15 or 14 or 13 or 12. So I need to save all of those onto the stack,
and I'll use them actually to restore when I'm all done. So push ar 15.
Bush are 14.
Push our 13
Okay. And then as faras parameters go, this is actually a parameter number nine.
This one is
14. And then we got 15 in 16 for these two.
All right, so now I have saved them all onto my stack.
Um, one of the things we're gonna want to do is restore them. So I'm going to do that at this point, and then we're going to set up,
um, a couple of extra ones that we've already done here. So I gotta pop them in the reverse order. So pop are
pop are 11
pop are 12 pop or R 13
Okay, so these air the registers that I just got done pushing on,
um, I also then need to add to our SB,
eight times two
there. No, Sorry
at our SB 10.
All right. So appear I pushed on two parameters. That's 10 hex, and I don't need the values of them. So I'm just going to
I'm correct the stack there. And now I need to pop off all my general ones that I push on again. So pop R nine
sorry are eight
r d x
r c x
r B x.
so this should be the reverse order that I had done them before.
Just double check hip. I got 89 and then 98
so we've set up these parameters basically nine through,
16. We needed and then set the rest of them up. So the easiest way to do that is to basically move into registers. Devise that we're going to care about the scroll up so we can see,
um, are offsets here.
So I'm going to use our eight, because I
I'm going to use that at the very end
or one of the end ones. So it's It's an easy one, and it's shorter than some of the others. So move into our eight.
So for this one, I want to do parameter eight.
And so parameter eight is going to be our nine.
RSP so we're gonna reference are sorry, Rvp
your efforts on a stack pointer and we're going to subtract
40 hex. So if we look for our nine, we see that that that's that 40 hex below are BP,
So we'll go ahead and move that into
are eight, and then just say,
push our eight.
Okay, so the next one we're gonna do
And if we looked at our format, string number seven is going to be our eight.
So again, we move into our eight
r b B P minus.
So are eight is going to be at 38 some minus 38 texts.
Push our eight.
The next one that we're going to do
is six, and that's going to be our D. I
so move into our eight
r B P
So that's at 30 Hex
and then push our eight. So here we just keep
moving these in, so that way we can push them onto the stack, because again, all of the
things that aren't going to fit in our first set are gonna have to go on the stack. And so here is our last one that we have to do this way.
So we're gonna do five.
That's gonna be or s I
So if we look up there, move into our eight. So our size at minus 28
R B E p
minus 28 texts
and then we push it
so that takes care of
and it help if I could spell these. All right,
so now that we have them all onto the stack, then we can do our our last four parameters in the way that we need to do them.
So the fourth parameter goes into our eight,
and for that I'm gonna use RDX,
So that's parameter for
move into our
Well, it actually ends up being R c x for that one. So that's parameter
three for parameter to
And the argument that I had put on there
is going to RB RB x
So I have RDX r c x R B X and then
are a X
into our S I So that's the location interested that we have to have and we need our e X,
and that is parameter one for our print.
And then we use
r D I for our format strings. This is called Just dump,
um, and then we for using print off, we need to move into R E X,
the number zero.
And then we should be able to,
um, call that function
so we will be able to call print f
with reference to the PLT.
And then we did push on,
um, some parameters here, and so we're going to go ahead and correct those.
So if we see here, we pushed on
add to RSP
eight times four.
So we'll just
add into it. We can do the math there, and so that should make it all work out
So the hard part was making sure that we got our format string appropriate for all of those inputs. Uhm, I ended up leveraging the fact that we needed to save all these registers. So that way
we had less time spent doing it. Otherwise, I have to push every single one of the registers
and then copy all their contents back onto the stack again. And so these registers here, being pushed onto the stack are going to be used inside of the print F
because it's easier to do that, then to do this complicated step of copying something from the stack and then pushing it back on.
Um, it's just a simpler way in order to do that.
so that should be our function.
See if I made any,
Oh, what A
that I miss Type it here.
So here, that's print half.
And I might have
lower case D. All right.
All right. So now we've built our project, and so what I want to do is go into 15.4
And so here we can call dump rags. So some fun things to do is to pick some registers and move
R E X
one move R B X
and then we end up calling dump rags,
And so then we end up with when we got our one or two are three printed off and you can see we have things like Rvp and RSP again. If we set those values to specific numbers, then we would see those appropriately set up
and so you can go in there and, you know, change some of these to test it out.
Here we go.
And so we got our feed beef in there,
so that was an example of how you could rewrite some of those functions.
And, um, there are a lot of different functions that need to be rewritten in order to be used for,
um 64 big code. So if that's something you're interested, you can work on that.
So today we went through and we wrote a 64 bit dump register dysfunction
and learned how to make sure we push everything onto the stack appropriately,
um, so that we could call that print F and then use the with reference to for the Plt.
If you have questions, you can email me Miller M J U N K i e to you. You can find me on Twitter. Have no house 30.
How to Use GDB (BSWJ)
In this part of the Breaking Stuff with Joe (BSWJ) series, Joe Perry demonstrates how ...
Certificate of Completion Offered
How to Use IDA (BSWJ)
The IDA is used throughout the IT and cybersecurity industries by exploit developers, vulnerability analysts, ...
Certificate of Completion Offered