0

I'm using gdb I have this:

0x00000000004006d0 <+106>:  callq  0x400540 <strcmp@plt>
0x00000000004006d5 <+111>:  test   %eax,%eax
0x00000000004006d7 <+113>:  je     0x400725 <main+191>
0x00000000004006d9 <+115>:  mov    $0x4007c8,%esi
0x00000000004006de <+120>:  mov    $0x400858,%edi
0x00000000004006e3 <+125>:  callq  0x400560 <fopen@plt>
0x00000000004006e8 <+130>:  mov    %rax,-0x10(%rbp)
0x00000000004006ec <+134>:  mov    -0x10(%rbp),%rdx
0x00000000004006f0 <+138>:  lea    -0x60(%rbp),%rax
0x00000000004006f4 <+142>:  mov    $0x40,%esi

after set {unsigned char *}0x00000000004006d7=0x75 it becomes this:

0x00000000004006d0 <+106>:  callq  0x400540 <strcmp@plt>
0x00000000004006d5 <+111>:  test   %eax,%eax
0x00000000004006d7 <+113>:  jne    0x4006d9 <main+115>
0x00000000004006d9 <+115>:  add    %al,(%rax)
0x00000000004006db <+117>:  add    %al,(%rax)
0x00000000004006dd <+119>:  add    %al,(%rax)
0x00000000004006df <+121>:  pop    %rax
0x00000000004006e0 <+122>:  or     %al,0x0(%rax)
0x00000000004006e3 <+125>:  callq  0x400560 <fopen@plt>
0x00000000004006e8 <+130>:  mov    %rax,-0x10(%rbp)
0x00000000004006ec <+134>:  mov    -0x10(%rbp),%rdx
0x00000000004006f0 <+138>:  lea    -0x60(%rbp),%rax
0x00000000004006f4 <+142>:  mov    $0x40,%esi

what am I doing wrong?

ruslan jankurazov
  • 23
  • 1
  • 4
  • You mean why does the destination address change? That does seem weird. `0x75` is JNE rel8, and we can tell from the start address of the next instruction (in the original) that it was using the short `rel8` encoding (not the `0F 84 rel32` JE near encoding). Use `x` to dump the raw bytes... oh nmv, we can see that you zeroed several bytes after as well. (`add %al, (%rax)` is how `00 00` decodes). – Peter Cordes Dec 03 '17 at 05:43
  • thats the problem. i dunno how to fix it – ruslan jankurazov Dec 03 '17 at 05:45
  • Did you literally use `{unsigned char*}` curly braces instead of `(unsigned char*)` parens for C cast syntax? Also try `set ((unsigned char *)0x4006d7) = 0x75` to make sure the cast has precedence over the assignment. Or look at the help for `set`, maybe it has a size option, I forget. – Peter Cordes Dec 03 '17 at 05:46
  • getting this: "(gdb) set ((unsigned char *)0x4006d7) = 0x75 Left operand of assignment is not an lvalue." – ruslan jankurazov Dec 03 '17 at 05:47
  • Hmm, I think just dereference it with `*`, like in C. `set (*(unsigned char *)0x4006d7) = 0x75`. – Peter Cordes Dec 03 '17 at 05:51
  • Or `set {char}0x4006d7 = 0x75` would have worked. `char*` is a 64-bit type, so **the syntax you used stored `0x75` *as an 8-byte pointer*.** – Peter Cordes Dec 03 '17 at 05:54

0 Answers0