Re: asm to hex, with a random string

[AK <platsakos () gmail com>]

Hi David3,
I do not fully understand your email (English is a second language for
me at best). My questions are inline:
On 4/27/12 12:32 PM, David3 Gonnella wrote:
> After some study i realized that if you want clever assembly you
> have to rely on C, just because more complex operations in the end
> are associations of hexes that vary on architectures
Documented on "Shellcoder's handbook". I do not understand your last
sentence, ALL operations end up as bytecode, not just the complex ones.
> You can just compile and link you program on two different architecture,
> get the hexes from the final bin and you have the logic you wrote as i
> would when i was asking.
I will send in your personal email a blog post that I have written for
asm <-> shellcode (note the <->). I can also send it to the list,
although this has been done to death :(
> Well, that question was not clear also to me, just because was done like
> when  you are thinking about something ..you still do not know well.
>
> Yes change a string is not difficult having all architecture factors in
> mind but if you want that the string gets the current name of day of the
> week, for example, you can't [corrected by me] do that on the assembly
> ..at least for humans ..AFAIK...
Some people can do. String perhaps is not the proper term, in general
when I see string in a payload context, my mind wanders off to NUL
terminated strings. Still, provided that the substitute is of less or
equal length and that the code was written in a PIC way, you can
substitute instructions on the fly (JNE -> JMP patching for example).
The question is still not clear to me, can you please rephrase?
HTH
> David3
>
>
> On 04/27/12 11:39, AK wrote:
> > The question is not entirely clear to me but if by string you mean 
> > something along the lines of changing for example /bin/bash to
> > /tmp/tcsh or something, indeed you can do that, provided that you
> > keep endianess and other factors in mind. Why is this useful?

_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework