I'm using fnstenv
FPU instruction to get the EIP in a 64 bit shellcode. Running it in GDB everything looks fine:
0x0000000000400080 ? fldz
0x0000000000400082 ? fnstenv [rsp-0xc]
After running these instructions by stepping in with si
I get in the stack the right value (0x0000000000400082).
What I miss is this: if I place a breakpoint after the fnstenv
and then with continue
I execute without a breakpoint between them, I get a wrong value: 0x0000003300400082.
The 0x00000033 is the value of CS register...not sure if this is a coincidence or not.
I'm using nasm and ld with the following syntax:
nasm -f elf64 shell.asm -o shell.o
ld shell.o -o sh --omagic
User contributions licensed under CC BY-SA 3.0