div idiv

div:
   div ebx     ;     eax = edx:eax  /  ebx  .   remainder will be put in edx


example:
   mov edx, 0
   mov eax, 0xd
   mov ebx, 5
   div ebx
   ;; result:   eax=2,  edx=3

#somehow my immunity debugger not accept 'div 0x75' instruction

idiv:
   signed version of div

inline hook

a) distance to jump, will be use at (d)
b) copy original instruction at original function to new area in memory.
c) put 'jmp' at original function
d) put (a) at (original_function +1). as parameter to jmp in (c)
 

repne scasb, rep movsb

a) to count string length. Looks at how ECX is used, 'neg ecx' 
b) to copy string to somewhere in memory



NOTES

scasb:
   cmp al, [edi]
   ##add esi, 1
   add edi, 1


repne scasb:
  repeat 'not equal' or 'ECX times',



movsb:
  mov byte [edi], [esi]
  add esi, 1     ; depending on direction flag, might be decreased
  add edi, 1


rep:
  repeat ECX times

rep movsb:
   repeat while ecx not 0;
   sub ecx, 1
   (#repeat ecx times)





usually:
   'repne scasb' to count string lenght;
    'rep movsb' to copy string  

imul

mul:
  mul ebx ;     edx:eax =  eax * ebx
                 ;     decimal: 5,000,000,000
                 ;         edx          |   eax
                 ;     00000001     | 2A05F200


imul:
    imul eax, ecx, 0x2    ;    eax = ecx * 0x2

    imul ecx, 0x2           ;   imul ecx, ecx, 0x2  

loopw x86

mov  edi, DWORD_00406904
mov  ecx, 0x0d
LOC_4010682
xor  [edi], 0x9C
inc  edi
loopw LOC_04010682




loopw:
  ecx--
  jump if ecx != 0
 

setz

cmp eax, [ebp + 4] 

setz al ;set al to 1 if equal

ref http://stackoverflow.com/questions/6161809/optimised-assembly-equality-routine

compile assembly 32 bit atas platform 64 bit

Atas ubuntu 64 bit.

Utk kompile binary 64 bit:

nasm -f elf64 -g -F stabs a-eatclib.asm
gcc a-eatclib.o -o a-eatclib

Utk kompile binary 32 bit:

nasm -f elf -g -F stabs a-eatclib.asm
gcc a-eatclib.o -o a-eatclib -m32

assembly panggil libc

cara assembly  panggil libc:  [printf]

; cara nak kompil

;    nasm -f elf -g -F stabs a-eatclib.asm
;    gcc a-eatclib.o -o a-eatclib -m32


EatMsg: db "Saya makan Nasi 0x%x pinggan/n",0
EatMsg2: db "Saya makan Nasi 0x%x pinggan/n",10, 0  ; yg ni baru ada new line
extern printf
global main ; Required so linker can find entry point

main:
push ebp ; Set up stack frame for debugger
mov ebp,esp
push ebx ; Program must preserve ebp, ebx, esi, & edi
push esi
push edi
;;; Everything before this is boilerplate; use it for all ordinary apps!

push esp
push EatMsg
call printf
add esp, 4

;;; Everything after this is boilerplate; use it for all ordinary apps!
pop edi ; Restore saved registers
pop esi
pop ebx
mov esp,ebp ; Destroy stack frame before returning
pop ebp
ret ; Return control to Linux

getPC

GetPC:

• adalah satu teknik digunakan utk dapatkan eip semasa. (dalam shellcode)
• http://skypher.com/wiki/index.php/Hacking/Shellcode/GetPC

Kaedah 1.

$+0:    E8 00000000 CALL    $+5         ; PUSH $+5 onto the stack
$+5:    59          POP     ECX         ; ECX = $+5
$+6:    ...shellcode...

Oleh kerana argument kepada CALL (E8) adalah relatif(offset) kepada kod CALL, maka value-nya ialah 0. Tapi nullbyte ni tak boleh guna dalam shell code.

Kaedah 2)

$+0     EB XX       JMP     SHORT $+N   ; Jump to the call instruction
$+5:    59          POP     ECX         ; ECX = $+N+5
$+6:    ...shellcode...
$+N:    E8 FFFFFFXX CALL    $+5         ; PUSH $+N+5 onto the stack and jump back to $+5

Kaedah ni limitationnya adalah pada saiz shellcode. Saiz maksimum adalah 126 bytes. Kalau nak lebih besar, kena buat jump pada lokasi $+N-2, jump kepada $+N+5.
Flow eip seperti berikut:

1. $+0
2. $+N
3. $+5   ;  ecx  dapat lokasi $+N+5
4. $+6   ;  execute shellcode

Kaedah 3)

$+0  EB FFFFFFFF CALL    $+4         ; PUSH $+5 onto the stack and jump to $+4
$+5: C8 59XX XX  ENTER   XX59,XX     ; Does not get executed like this; see below.

Kaedah guna trik yg menarik. Bila [call $+4 ] di larikan, EIP akan jadi $+4, bukan $+5. Jadi instruction yg akan dijalankan adalah spt berikut:

$+4:  FFC8     DEC     ECX   ; Does nothing useful; can be considered a NOP.
$+6:  59       POP     ECX   ; ECX = $+5
$+7:    ...shellcode...

masih signed dan unsigned

Kes 1
c code:

unsigned int a = 5;
signed int b = -1;
if(a > b)

assembly code:

mov DWORD PTR [esp+24], 5
mov DWORD PTR [esp+28], -1
mov eax, DWORD PTR [esp+28]
cmp eax, DWORD PTR [esp+24]
jae .L2

Kes 2

c code:

     signed int a = 5;
     signed int b = -1;
     if(a > b)

assembly code:

        mov     DWORD PTR [esp+24], 5
        mov     DWORD PTR [esp+28], -1
        mov     eax, DWORD PTR [esp+24]
        cmp     eax, DWORD PTR [esp+28]
        jle     .L2 

Kesimpulan:
jika a dan b adalah signed int, maka compiler akan guna jle.
Tapi jika salah satu unsigned int, maka compiler akan guna jae(sebab eax = esp+28 instead +24)

signed vs unsigned int

01 void main(){
02     unsigned int a = 5;
03     signed int b = -1;
04     if(a > b)
05         printf("True");
06     else
07         printf("False");
08     }

Hasil >>  False  ( line 07)

Kenapa?
Sebab perbandingan di buat antara signed dan unsigned.
Compiler akan assume perbandingan dibuat guna mode unsigned.

Note:  jika mode signed, assembly instruction yg digunakan adalah jg(jump greater ).
Jika mode unsigned, assembly instruction adalalah ja(jump above )

Data variable a yg disimpan dalam memori adalah 0x00000005.
Data variable b yg disimpan dalam memori adalah 0xffffffff (value adalah -1)

utk jg:
  a > b    # hasilnya true

utk ja:
  a > b    # hasilnya false  (sebab 0x00000005 (a) lebih kecil dari  0xffffffff (b) )

assembly code utk line 04:
mov eax, 0x5
mov ebx, 0xffffffff
cmp eax, ebx
ja binary.true

(kalau both variable adalah signed int, compiler akan gunakan jg, bukan ja)

extra:
JG will jump if ZF = 0 and SF = OF
JA will jump if CF = 0 and ZF = 0
(ref. http://www.unixwiz.net/techtips/x86-jumps.html)

ror x86

shift right ->(digit paling kanan pindah letak kat depan)

katakan a = 1001   ; 9

ror a, 1  ->>  1100 ; c
ror a, 2  ->>  0110 ; 6
ror a, 3  ->>  0011 ; 3


katakan eax = 90 00 00 09      <  1001 0000 0000 0000 0000 0000 0000 1001
ror eax, 1 >>    c8 00 00 04     < 1100 1000 0000 0000 0000 0000 0000 0100
ror eax, 2 >>    64 00 00 02     < 0110 0100 0000 0000 0000 0000 0000 0010
ror eax, 3 >>    32 00 00 01     < 0011 0010 0000 0000 0000 0000 0000 0001

opcode kepada assembly

objdump -b binary -m i386 -D shellcode.bin

refer to http://siperdana.blogspot.com/2012/05/convert-assembly-to-opcode.html

loop x86

loop next:
jump to next jika ecx > 0

if ecx > 0
    eip = next

cld vs std

cld akan setkan DF(direction flag) kepada 0
std akan setkan DF kepada 1

DF akan tentukan nilai ESI menaik atau menurun utk arahan 'lodsd'

mov esi, 40100; esi: 40100
cld           ; DF: 0
lodsd         ; esi: 40104
lodsd         ; esi: 40108
std           ; DF: 1
lodsd         ; esi: 40104
lodsd         ; esi: 40100

LODSD

opcode:AD
assembly:  LODSD

equal to>>
mov eax,[esi]
add esi,4

cmp dan test

cmp eax,4 >> eax - 4
SF : signed flag. Tukar jadi satu jika hasil tolak eax dengan 4 bernilai negatif
ZF: zero flag. Tukar jadi satu jika hasil tolak eax dan 4 bernilai 0.

instruction	Zero Flag	Sign Flag	Overflow Flag	|	JG	JE	JL
mov eax, 3 cmp eax,4	0	1	0		-	-	jump
mov eax, 4 cmp eax,4	1	0	0		-	jump	-
mov eax, 5 cmp eax,4	0	0	0		jump	-	-

test eax,4 >> bitwise 'AND' antara eax dan 4, Tukar flags SF, ZF, PF, CF, OF

instruction	Zero Flag	Sign Flag	Overflow Flag	|	JG	JE	JL
mov eax, 3 test eax,4	1	0	0		-	-	jump
mov eax, 4 test eax,4	0	0	0		-	jump	-
mov eax, 5 test eax,4	0	0	0		jump	-	-

ref>> http://www.unixwiz.net/techtips/x86-jumps.html

assembly: call to hardcoded address

a)   mov eax, 0x7c81CDDA
      call eax

vs

b)  call 0x7c81CDDA

Nampak macam sama. Tapi sebenarnya tidak.
Untuk a, selepas call eax, eip = 0x7c81CDDA

Untuk b selepas call, eip = 0x7cc33dda

Utk buat call secara hardcoded ke alamat 0x7c81CDDA:
    call 0x7C405DDa

Ada offset sebanyak 41700A.

Di uji menggunakan libemu(sctest)
Di kompil guna nasm

convert assembly to opcode

1) gadget.asm

;gadget.asm
[SECTION .text]
; set the code to be 32-bit
; Tip: If you don't have this line in more complex shellcode,
; the resulting instructions may end up being different to
; what you were expecting.
BITS 32
global _start
_start:
POP EAX
POP EDI
POP ESI
POP EBX
POP EBP
RETN

2) Compiling assembly code

# nasm -f bin -o gadget.bin gadget.asm

3) Obtaining shellcode

#objdump -b binary -m i386 -D gadget.bin

atau

# x86dis -e 0 -s intel -f gadget.bin
00000000 58                             pop     eax
00000001 5F                             pop     edi
00000002 5E                             pop     esi
00000003 5B                             pop     ebx
00000004 5D                             pop     ebp
00000005 C3                             ret

 atau

# xxd -i gadget.bin
unsigned char gadget_bin[] = {
  0x58, 0x5f, 0x5e, 0x5b, 0x5d, 0xc3
};
unsigned int gadget_bin_len = 6;

ref>> http://www.projectshellcode.com/node/18 

pushad

Push EAX, ECX, EDX, EBX, original ESP, EBP, ESI, and EDI.