fnstenv FPU instruction to get the EIP in a 64 bit shellcode. Running it in GDB everything looks fine:
0x0000000000400080 ? fldz 0x0000000000400082 ? fnstenv [rsp-0xc]
After running these instructions by stepping in with
si I get in the stack the right value (0x0000000000400082).
What I miss is this: if I place a breakpoint after the
fnstenv and then with
continue I execute without a breakpoint between them, I get a wrong value: 0x0000003300400082.
The 0x00000033 is the value of CS register...not sure if this is a coincidence or not.
I'm using nasm and ld with the following syntax:
nasm -f elf64 shell.asm -o shell.o ld shell.o -o sh --omagic
User contributions licensed under CC BY-SA 3.0