Hacker News Reader

Comment by tonyarkles | Hacker News Reader

Note that x86 has variable-length instructions, so incrementing RIP by 10 will not, in general, do what you want it to do. The author basically put in a nop slide[1] to ensure that that would work. Buuuuuut I’m pretty sure you could parse ELF debug symbols and effectively calculate the address of the next logical C instruction to execute :D

Terrifying but fun!

[1] https://en.wikipedia.org/wiki/NOP_slide

View on HN

Or decode the x86 stream to find the next instruction. :-)

Next C statement is pretty cute, though.

Interesting problem - what's the shortest C function that takes a pointer to bytes and returns the length of the x86-64 instruction there? (and how many hours would it take to code it)

Start here and minimize as you see fit: https://intelxed.github.io/ref-manual/group__DEC.html#ga4bef...

The cheating way is probably to do this https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Bre... (page ~71) i.e. shift across an instruction boundary.

Put it on a page boundary. Make sure the next page isn't accessible. Analyze the resulting page fault.

On Error Resume Next

That reminds me of the time I saw a C# database save function looking at the stack trace to figure out if it had already been called, exiting if it saw itself on the stack.

I mean, it's not wrong, but it is crazy.

If I recall, I once did something like this in Python that modified variables in its caller. Not for production, just for shits and giggles :D

https://github.com/ajalt/fuckitpy

Is a larger slide and RIP increment needed then? Or can these never be made large enough?

The reason this worked in this example is because they knew which line would cause the SEGV. In the general case where you're trying to catch arbitrary segfaults, you'd need a slide in between every instruction if you wanted to do a fixed RIP increment.

What you really need to do is figure out which instruction was executing and increment RIP appropriately.

Reply on news.ycombinator.com