blatherskite, but the 'rs' is in the code. Expanding on the project
gibberish, which demonstrates using jmp
instructions to jump through an
x86 execution flow, blathekite
does this by trusting the compiler to compile
to the instructions we want and in the order we want.
This project works on target-cpu=generic
- any sort of extra optimizations could
mess with the relative addressing.
Since ABIs for x86 architectures usually define rdi, rsi, ... as
registers for arguments to be passed in and rax as the register for
the return value, the compiler will optimise an add function to use
a lea
instruction first, as the SIB-byte
allows us to perform quick
addition, multiplication and subtraction, whilst also writing the result
to a seperate register.
Therefore, we may notice that in the deadname
function, we assign the
sum of variables di and si to an accumulator variable. This eliminates
the initial use of a lea
instruction for further add
operations.
Despite the source code from 1.68.0 to 1.68.1 only having 46 additions and 14
deletions, the update happens to absolutely reorganise the function ordering
of blathekite, where the volatile
module gets compiled before the main
file, causing the relative addressing to jump to unintended memory addresses.