5

I'm trying to write some shellcode that will eventually be in the form of an English paragraph. This means that I'm mostly limited to instructions that have opcodes that evaluate to alphanumeric characters or punctuation. This actually leaves me with many different jump instructions including: jo, jno, jb, jae, je, jne, jbe, ja, js, jns, and jp (which correspond to letters p-z). Each of these jumps performs a test before it decides to jump or not. In most cases I can combine a jump plus its inverse to ensure a jump will take place in the shellcode (e.g. using jo then jno, or je then jne), but I cannot do this in the case of jb. The test for jb is CF=1.

My question is, is there any series of alphanumberic instructions that is functionally a NOP, but also ensures that CF=1? CF is the carry flag, so any operations that are guaranteed to set the carry flag would suffice.

Also to ensure a jae, is the anyway to ensure that the CF=0?

2
  • Great question. I don't really see a solution to this, but I'm really looking forward to any developments. STC would be perfect here, but it's F9, which doesn't have anything to do with ASCII. May 17, 2012 at 14:24
  • The eventual goal of this is English shellcode, so shellcode using letters, numbers, and punctuation is what I'm working with. The most useful though are English words or common English digraphs or trigraphs that can be put within other code.
    – cytinus
    May 19, 2012 at 2:20

1 Answer 1

5
+50

You can use "4444" to set CF to 0.

"44" is XOR AL, 0x34.

2 XORs with the same value result no change in AL.

It should be noted, though, that XOR affects almost all arithmetic flags (effect on AF is undefined). So, it's not completely "NOP".

In 32-bit mode you can use "PhohohX7X" to set CF to 1.

"P" is PUSH EAX.
"hohoh" is PUSH 0x686F686F.
"X" is POP EAX.
"7" is AAA.
"X" is POP EAX.

There's a caveat with AAA, too. Its effect on most of arithmetic flags is undefined (CF and AF excepted, they become equal). So, it's not completely "NOP" either.

8
  • What is the nature of XOR and AAA's affect on CF? Do they always set it to 0 and 1 respectively?
    – cytinus
    May 18, 2012 at 19:48
  • 1
    XOR - always. AAA - no (if it had, I wouldn't have used PUSH and POP and some "magic" 0x686F686F value). See the CPU manual (from Intel or AMD) for details of their operation. May 18, 2012 at 19:54
  • Thanks this is very helpful conceptually. Eventually I want my shellcode to be English paragraphs, so opcodes that are statistically probably alphanumeric digraphs or words would be most convenient, though. This helped a lot though.
    – cytinus
    May 18, 2012 at 21:41
  • Also, AAA is not available in 64-bit mode. :( May 19, 2012 at 11:06
  • 1
    @DanielKamilKozar: which is why I wrote "In 32-bit mode...". IMUL can be used to set CF=1. May 19, 2012 at 21:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.