0

Since yesterday am trying to understand a challenge named hidden password from crackmes.

Isn't call instructions used for functions only? Why is it used with register? I did not find anything about that. (Look at 0x557d18421542)

    :> pid 20  @ 0x557d18421511
0x557d18421511       488b85d0feffff  mov rax, qword [rbp - 0x130]
0x557d18421518             4883c008  add rax, 8
0x557d1842151c               488b00  mov rax, qword [rax]
0x557d1842151f               4889c7  mov rdi, rax
0x557d18421522           e819fbffff  call sym.imp.strlen
0x557d18421527               4889c1  mov rcx, rax
0x557d1842152a       488b85d0feffff  mov rax, qword [rbp - 0x130]
0x557d18421531             4883c008  add rax, 8
0x557d18421535               488b00  mov rax, qword [rax]
0x557d18421538             488b55d0  mov rdx, qword [rbp - 0x30]
0x557d1842153c               4889ce  mov rsi, rcx
0x557d1842153f               4889c7  mov rdi, rax
0x557d18421542                 ffd2  call rdx
0x557d18421544               8945c8  mov dword [rbp - 0x38], eax
0x557d18421547             837dc800  cmp dword [rbp - 0x38], 0
0x557d1842154b                 740e  je 0x557d1842155b
0x557d1842154d       488d3dc20a0000  lea rdi, [rip + 0xac2]
0x557d18421554           e8d7faffff  call sym.imp.puts
0x557d18421559                 eb2c  jmp 0x557d18421587

Is it valid? If it is what does it do? Thank you

Peter Cordes
  • 328,167
  • 45
  • 605
  • 847
Ruth
  • 1
  • 4
    rdx would contain the address of the function to be called. – Sebastian Mar 18 '22 at 07:35
  • @Ruth it doesn't even have to be address of the function - it can be just an address (and more general a value) and the call will be performed. Ofc it can have undesired consequences but it's possible and such tricks are sometimes employed by crackmes – Paweł Łukasik Mar 18 '22 at 09:08
  • For future questions like these, please consult the Intel Software Development Manuals or some other instruction set reference. – fuz Mar 18 '22 at 12:01
  • 2
    @PawełŁukasik: it does have to be a valid pointer, not just any value. If it's not a canonical address, `call rdx` will fault with #GP. If it is canonical but not pointing to valid memory with execute permission, code-fetch after `call rdx` sets RIP = RDX will fault with #PF – Peter Cordes Mar 18 '22 at 13:59
  • those are the undesired consequences :). What I was conveying is there's no check on what value can be used as an address – Paweł Łukasik Mar 18 '22 at 16:14

0 Answers0