Hacker News Reader

Comment by thamer | Hacker News Reader

> Conditional control flow is possible thanks to this gem of an instruction:

    ff242500004000            jmp qword [0x400000]

How is this "conditional"? The article explains that it simply "jumps to whatever address is stored as a 64-bit quantity at address 0x400000", but where's the condition here?

View on HN

Because by being indirect, you can change the jump target in 0x400000 via the result of alu ops.

I'm guessing:

Create a 2-element array of branch targets. Compute a boolean condition function (0 or 1). Index into the 2-element array with this 0 or 1 value and write it into 0x400000, then jmp qword [0x400000].

Or know the difference between the addresses of the true pathway and the false pathway, multiply your 0 or 1 result by that difference and add that to whichever pathway's base is lower. No lookup table needed.

Everyone is finding a roundabout way to say “self modifying code”

No self modifying code needed, simply embracing pointer arithmetic more than is typically allowed without your sanity being brought into question. This technique works just fine with no changes to page permissions and W^X.

Changing and then calling a function pointer stored at some memory address isn’t really insane.

Since it's a jmp rather than a call it's not really a function pointer, but instead a basic block pointer that you're doing arithmetic on.

Reply on news.ycombinator.com