Access to Program Counter in C
Try :
Call ($+5)
pop ebp
you will get the current instruction which u r executing in ebp !! This is how viruses works, they decrypt it in the memory and starts executing from the memory afterwardz..
Here CALL instruction is 4 bytes instruction so call $+5 will call the 5th byte which is the next instruction. And based upon the "call" behavior, it pushes the next instruction on the stack first and then JUMP to the instruction. So, in this case, on the stack you will have the exact instruction which you are executing !
Enjoy,
Siddharth.
----- Original Message -----
From: sandeep <[email protected]>
Date: Thursday, November 18, 2004 10:32 pm
Subject: Re: Access to Program Counter in C
Quoted 49 lines
Quoted 3 lines · A M
Does anybody know how to access the address of the current executing instruction in C while the program is executing?
doing exactly as your words say, won't be possible (as far as my limited experience with ix86 architecture goes), but something nearabout can be achieved with little inline assembly fragment.
you might find it useful/helpful to have a look at some of the early days virus
codes. search on internet for sources for them.Quoted 5 lines
Also, is there a method to load a program image from memory not a file (an exec that works with a memory address)? Mainly I am looking for a method that brings a program image into memory modify parts of it and start the in-memory modified version.
should be possible to have your version of exec (modified exec). file-image is
also a sequence of bytes like any sequence of bytes in memory. normal exec would
expect a particular layout/structural-organisation of the content in this
sequence. what kind of layout/content you plan to have in your memory image
would also decide how much different your version of exec would be.Quoted 2 lines
Can anybody think of a method to replace a thread image without replacing the whole process image?
will something on the lines of MS-DOS overlays work for you?
Signature · 15 lines
regards sandeep -------------------------------------------------------------------- ------ It is said that the lonely eagle flies to the mountain peaks while the lowly ant crawls the ground, but cannot the soul of the ant soar as high as the eagle? -------------------------------------------------------------------- ------ - To unsubscribe from this list: send the line "unsubscribe linux-c- programming" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 5 lines · On Thu, 18 Nov 2004 23:31:25 -0800 siddharth vora <[email protected]> wrote:
Try :
Call ($+5)
pop ebp
yes, something like that.
In x86(DOS) when u do a call to near function(near, that means program don't change a code segment(CS) register) processot does something like this:
mov sp,sp-2 mov [sp],ip (next executable ip)
when call'e ret executed processor does:
mov ip,[sp] mov sp,sp+2
so, you inscruction after call should be
call <some function> mov [ipdrr], sp-2
you'll get the IP if this instuction;]
I think u got the idea, look for call inctruction execution inside cpu for more details. I whote here with intension that cpu's word is 2B;]
_
Justinas Gulbinas
[email protected]
Quoted 5 lines · siddharth vora
Here CALL instruction is 4 bytes instruction so call $+5 will call the 5th byte which is the next instruction. And based upon the "call" behavior, it pushes the next instruction on the stack first and then JUMP to the instruction. So, in this case, on the stack you will have the exact instruction which you are executing !
am i right in taking it as, you meant to say - execution of call instruction pushes the return address, which is the address of instruction following call instruction. in the example you mentioned it would be the address of instruction "pop ebp". since you are jumping to this instuction (via call), at the end of it's execution ebp will have the address of "pop ebp" instruction.
Signature · 7 lines
regards sandeep -------------------------------------------------------------------------- It is said that the lonely eagle flies to the mountain peaks while the lowly ant crawls the ground, but cannot the soul of the ant soar as high as the eagle? --------------------------------------------------------------------------