DevHeads IoT Integration Server•14mo ago

How to Preserve 64-bit Register Values When Using movl in x86_64 ROP Constraints

Marvee Amasi · 2024-12-17T17:36:09.988Z

In x86 64 machine code, when the `movl` instruction is used with a register destination, it zeroes the higher order bytes of the 64 bit register. How can I use `movl` while preserving the original value of the full 64-bit register? For example, if I ```movq %rsp, %rax``` and then call ```movl %eax, %edx``` is there a way to use `movl` or perform some other operations after `movl` so that `%rdx` retains the original value of `%rsp`? I cant use `movq` bcus in my current situation ***a ROP attack**, only `movl` instructions are available in my gadget farm actually. I also have access to `andb`, `orb`, `cmpb`, and `testb` instructions

In x86 64 machine code, when the

movl

movl

instruction is used with a register destination, it zeroes the higher order bytes of the 64 bit register. How can I use

movl

movl

while preserving the original value of the full 64-bit register?

For example, if I

movq %rsp, %rax

movq %rsp, %rax

and then call

movl %eax, %edx

movl %eax, %edx

is there a way to use

movl

movl

or perform some other operations after

movl

movl

so that

%rdx

%rdx

retains the original value of

%rsp

%rsp

?

I cant use

movq

movq

bcus in my current situation *a ROP attack, only

movl

movl

instructions are available in my gadget farm actually. I also have access to

andb

andb

orb

orb

cmpb

cmpb

, and

testb

testb

instructions

DIIS

DevHeads IoT Integration Server•14mo ago

Marvee Amasi

How to Preserve 64-bit Register Values When Using movl in x86_64 ROP Constraints

In x86 64 machine code, when the

movl

movl

instruction is used with a register destination, it zeroes the higher order bytes of the 64 bit register. How can I use

movl

movl

while preserving the original value of the full 64-bit register?

For example, if I

movq %rsp, %rax

movq %rsp, %rax

and then call

movl %eax, %edx

movl %eax, %edx

is there a way to use

movl

movl

or perform some other operations after

movl

movl

so that

%rdx

%rdx

retains the original value of

%rsp

%rsp

?

I cant use

movq

movq

bcus in my current situation *a ROP attack, only

movl

movl

instructions are available in my gadget farm actually. I also have access to

andb

andb

orb

orb

cmpb

cmpb

, and

testb

testb

instructions

How to Preserve 64-bit Register Values When Using movl in x86_64 ROP Constraints

Similar Threads

How to Preserve 64-bit Register Values When Using movl in x86_64 ROP Constraints

Similar Threads

Similar Threads

Similar Threads