89 lines
2.8 KiB
Plaintext
89 lines
2.8 KiB
Plaintext
First three arguments:
|
|
rdi 0xdeadbeefdeadbeef
|
|
rsi 0xcafebabecafebabe
|
|
rdx 0xd00df00dd00df00d
|
|
|
|
|
|
weird-ass instructions:
|
|
0x0000000000000a08 : retf 0xbabe
|
|
|
|
|
|
ret2win@plt: 0000000000400510
|
|
|
|
0x00000000004006a3 : pop rdi ; ret
|
|
0x00000000004006a1 : pop rsi ; pop r15 ; ret
|
|
|
|
|
|
|
|
|
|
ret2csu: file format elf64-x86-64
|
|
|
|
|
|
Disassembly of section .init:
|
|
|
|
Disassembly of section .plt:
|
|
|
|
Disassembly of section .text:
|
|
|
|
0000000000400640 <__libc_csu_init>:
|
|
400640: 41 57 push r15
|
|
400642: 41 56 push r14
|
|
400644: 49 89 d7 mov r15,rdx
|
|
400647: 41 55 push r13
|
|
400649: 41 54 push r12
|
|
40064b: 4c 8d 25 9e 07 20 00 lea r12,[rip+0x20079e] # 600df0 <__frame_dummy_init_array_entry>
|
|
400652: 55 push rbp
|
|
400653: 48 8d 2d 9e 07 20 00 lea rbp,[rip+0x20079e] # 600df8 <__do_global_dtors_aux_fini_array_entry>
|
|
40065a: 53 push rbx
|
|
40065b: 41 89 fd mov r13d,edi
|
|
40065e: 49 89 f6 mov r14,rsi
|
|
400661: 4c 29 e5 sub rbp,r12
|
|
400664: 48 83 ec 08 sub rsp,0x8
|
|
400668: 48 c1 fd 03 sar rbp,0x3
|
|
40066c: e8 5f fe ff ff call 4004d0 <_init>
|
|
400671: 48 85 ed test rbp,rbp
|
|
400674: 74 20 je 400696 <__libc_csu_init+0x56>
|
|
400676: 31 db xor ebx,ebx
|
|
400678: 0f 1f 84 00 00 00 00 nop DWORD PTR [rax+rax*1+0x0]
|
|
40067f: 00
|
|
_______this shit is importaint!!!!!!
|
|
\/
|
|
400680: 4c 89 fa mov rdx,r15
|
|
400683: 4c 89 f6 mov rsi,r14
|
|
400686: 44 89 ef mov edi,r13d
|
|
400689: 41 ff 14 dc call QWORD PTR [r12+rbx*8]
|
|
_________________________
|
|
40068d: 48 83 c3 01 add rbx,0x1
|
|
400691: 48 39 dd cmp rbp,rbx
|
|
400694: 75 ea jne 400680 <__libc_csu_init+0x40>
|
|
400696: 48 83 c4 08 add rsp,0x8
|
|
_________________________
|
|
40069a: 5b pop rbx
|
|
40069b: 5d pop rbp
|
|
40069c: 41 5c pop r12
|
|
40069e: 41 5d pop r13
|
|
4006a0: 41 5e pop r14
|
|
4006a2: 41 5f pop r15
|
|
4006a4: c3 ret
|
|
|
|
Disassembly of section .fini:
|
|
|
|
calling x86:
|
|
|
|
controlling rdx:
|
|
|
|
2: 0x40069a
|
|
rbx: 0 <--
|
|
rbp: 1
|
|
r12: 0xffffffff <-- next location. lets try to make it
|
|
r13: whatever I guess <-- would be nice if we could use a 64 bit value
|
|
r14: 0xcafebabecafebabe
|
|
r15: 0xd00df00dd00df00d <--
|
|
|
|
we can set r12 to [function@plt], and rbx to desired offset.
|
|
|
|
0x00000000004004e0 : call rax
|
|
|
|
target address: 0x00000000004006a3
|
|
0000000000400510 ret2csu
|