Hacker News Reader

Comment by kuroguro | Hacker News Reader

Used the exact same trick when researching dumb ways to break AV signatures at uni :)

You can also abuse the displacement math with eiz:

  ff 34 24 push   DWORD PTR [esp]
  ff 34 e4 push   DWORD PTR [esp+eiz*8]

Or some useless prefixes may work:

  80 c0 53 add    al,0x53
  36 04 53 ss add al,0x53

View on HN

This is the first time I learned about eiz. Cool trick!

What’s eiz: https://stackoverflow.com/a/2553556/3125367

You won't find "eiz" in any Intel manual, and NASM doesn't recognize it either. x86 has no zero register¹.

This appears to be some GNU-specific syntax meaning "encode SIB byte with no index register". The only case where this would be required by the hardware is when using ESP/RSP as a base register, and every assembler should produce the correct encoding for that if you simply write [ESP].

So using "eiz" on GAS lets you control what is put into the (unused) scale field. One might call that a feature, but it is a meaningless encoding detail similar to which variant of "register to register" opcodes is emitted, something that I don't think any assembler gives you control over.

¹ except maybe on the microarchitectural level, but that isn't visible to the programmer

If I remember correctly there are also tricks like

  lea rax, [eiz+rbx*4]

instead of

  lea rax, [rbx*4]

because the latter will produce an heavier binary by being interpreted as

  lea rax, [00000000h+rbx*4]

Reply on news.ycombinator.com