Skip to content

phoreverpheebs/blathekite

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

22 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

blathekite

blatherskite, but the 'rs' is in the code. Expanding on the project gibberish, which demonstrates using jmp instructions to jump through an x86 execution flow, blathekite does this by trusting the compiler to compile to the instructions we want and in the order we want.

This project works on target-cpu=generic - any sort of extra optimizations could mess with the relative addressing.

Observations

'lea' instead of 'add' optimisation

Since ABIs for x86 architectures usually define rdi, rsi, ... as registers for arguments to be passed in and rax as the register for the return value, the compiler will optimise an add function to use a lea instruction first, as the SIB-byte allows us to perform quick addition, multiplication and subtraction, whilst also writing the result to a seperate register.

Therefore, we may notice that in the deadname function, we assign the sum of variables di and si to an accumulator variable. This eliminates the initial use of a lea instruction for further add operations.

A change between rust 1.68.0 and 1.68.1

Despite the source code from 1.68.0 to 1.68.1 only having 46 additions and 14 deletions, the update happens to absolutely reorganise the function ordering of blathekite, where the volatile module gets compiled before the main file, causing the relative addressing to jump to unintended memory addresses.

About

a low-level obfuscated hello world in x86-64 rust

Resources

Stars

Watchers

Forks

Packages

No packages published

Languages