XR3X
Clicky

Jump to content


Photo

Change segment registers

help

  • You cannot start a new topic
  • Please log in to reply
4 replies to this topic

#1 DualCoder

DualCoder

    Member

  • Associate
  • Reputation: 37
    Fair
  • 34 posts
  • LocationSweden

Posted 31 August 2013 - 12:40 AM

In x86-64 how can I change the value of a segment register? Or how can I know the starting address of a memory segment?

 

For instance

Please Login or Register to see this Hidden Content

compiles and runs without exceptions, but the value of the segment register fs is never changed, so how may I change it?

 

Or if i could make something like:

Please Login or Register to see this Hidden Content

And make the last two instructions read from the same memory address. (rbx = rcx)

 

I'm using FASM btw

 

//DualCoder



#2 x58

x58

    Advanced

  • Administrators
  • Reputation: 1,610
    Awesome
  • 2,200 posts
Contributor

Posted 31 August 2013 - 11:52 AM

Have been reading this. The answer might is there

Please Login or Register to see this Hidden Content



See chapter 3.3

Maybe this will clear things up too. But MASM is different because labels are case sensitive in FASM.

Please Login or Register to see this Hidden Content


Regards

Website & blog 1366x.org
Linux is awesome but also time consuming hungry




Forum - Rules & Regulations

FAQ


#3 karcrack

karcrack

    Advanced Member

  • Moderator
  • Reputation: 343
    Very Good
  • 303 posts

Posted 02 September 2013 - 05:58 PM

What are you trying to do? Changing SR can only be done in real mode... Doing it from protected mode will generate an exception.


  • x58 likes this

(PGP ID 0xCC050E77)

ASM, C, C++, VB6... skilled [malware] developer


#4 poison2012

poison2012

    Member

  • Members
  • Reputation: 31
    Fair
  • 47 posts

Posted 02 September 2013 - 08:24 PM

you can have the starting address by using either an API such like VirtualQuery or you can do from asm (it's 32 bit code but you can port it to 64bit):

Please Login or Register to see this Hidden Content

you clear the low bytes since memory blocks always starts on aligment for instance if you have 404543h after mask you get 400000h

you may also want to check if 400000h points to "MZ" signature, if not you have to go further by subtracting 10000h until you reach the MZ header.

ps.: you don't need to access segment register as everything is in "flat" mode, one big 4GB memory accesible for you (in 64bit it's even more)


  • x58 and DualCoder like this

#5 DualCoder

DualCoder

    Member

  • Associate
  • Reputation: 37
    Fair
  • 34 posts
  • LocationSweden

Posted 02 September 2013 - 09:07 PM

you can have the starting address by using either an API such like VirtualQuery or you can do from asm (it's 32 bit code but you can port it to 64bit):

Please Login or Register to see this Hidden Content

you clear the low bytes since memory blocks always starts on aligment for instance if you have 404543h after mask you get 400000h

you may also want to check if 400000h points to "MZ" signature, if not you have to go further by subtracting 10000h until you reach the MZ header.

ps.: you don't need to access segment register as everything is in "flat" mode, one big 4GB memory accesible for you (in 64bit it's even more)

 

Yes, you are right.

 

I allready know about the call pop trick to get the address of the code, no problem there.

I'm not trying to get the address of my code (already done), and it doesn't have a PE header so searching for MZ wouldn't work.

And yes you can access any address without using segment registers, but on Windows the fs (32bit) or gs (64bit) registers points to the TEB (Thread Environment Block), I want to trick the system to use different information, but since I seem to be unable to modify the registers, I will atempt to patch the code instead.

 

So I still don't know how to modify the segment registers, but might have found a workaround.

 

//DualCoder







Also tagged with one or more of these keywords: help