SlideShare una empresa de Scribd logo
1 de 13
Current instruction
                                                   Stack

         call mylongjmp
                                   void _fastcall
                            mylongjmp(myjmp_buf *, int)


 EIP     ESP
 EAX     EBP
                                                            Ret. From mylongjmp
 EBX     ECX
                          ecx holds the first argument of
 EDX      EDI              mylongjmp (fastcall of MSVC)
         ESI

ETC…        Registers


                              EIP     ESP

                              EBP     EBX

                              EDI     ESI
    Callee frame
                             Stack    Len

                             myjmp_buf

          =
Current instruction
                                                       Stack

            mov eax, edx
                                   eax stores return value


   EIP      ESP
   EAX      EBP
                                                               Ret. From mylongjmp
   EBX      ECX

   EDX      EDI

            ESI

  ETC…        Registers

 edx holds the second argument
of mylongjmp (fastcall of MSVC)    EIP    ESP

                                   EBP    EBX

                                   EDI    ESI
      Callee frame
                                  Stack   Len

                                  myjmp_buf

            =
Current instruction
                                       Stack

          mov edx, ecx


 EIP     ESP
 EAX     EBP
                                               Ret. From mylongjmp
 EBX     ECX

 EDX      EDI

         ESI

ETC…        Registers


                          EIP    ESP

                          EBP    EBX

                          EDI    ESI
    Callee frame
                         Stack   Len

                         myjmp_buf

          =
Current instruction
                                        Stack

       mov esp, [edx+4]


 EIP     ESP
 EAX     EBP
                                                Ret. From mylongjmp
 EBX     ECX

 EDX      EDI

         ESI

ETC…        Registers


                           EIP    ESP

                           EBP    EBX

                           EDI    ESI
    Callee frame
                          Stack   Len

                          myjmp_buf

          =
Current instruction
                                       Stack

          mov edi, esp


 EIP     ESP
 EAX     EBP
                                               Ret. From mylongjmp
 EBX     ECX

 EDX      EDI

         ESI

ETC…        Registers


                          EIP    ESP

                          EBP    EBX

                          EDI    ESI
    Callee frame
                         Stack   Len

                         myjmp_buf

          =
Current instruction
                                         Stack

       mov esi, [edx+24]


 EIP     ESP
 EAX     EBP
                                                 Ret. From mylongjmp
 EBX     ECX

 EDX      EDI

         ESI

ETC…        Registers


                            EIP    ESP

                            EBP    EBX

                            EDI    ESI
    Callee frame
                           Stack   Len

                           myjmp_buf

          =
Current instruction
                                         Stack

       mov ecx, [edx+28]


 EIP     ESP
 EAX     EBP
                                                 Ret. From mylongjmp
 EBX     ECX

 EDX      EDI

         ESI

ETC…        Registers


                            EIP    ESP

                            EBP    EBX

                            EDI    ESI
    Callee frame
                           Stack   Len

                           myjmp_buf

          =
Current instruction
                                      Stack
               cld
            rep movsb

                                              Callee frame
 EIP     ESP
 EAX     EBP
                                               Ret. From mylongjmp
 EBX     ECX

 EDX      EDI

         ESI

ETC…        Registers


                         EIP    ESP

                         EBP    EBX

                         EDI    ESI
    Callee frame
                        Stack   Len

                        myjmp_buf

          =
Current instruction
                                        Stack

       mov ebp, [edx+8]

                                                Callee frame
 EIP     ESP
 EAX     EBP
                                                 Ret. From mylongjmp
 EBX     ECX

 EDX      EDI

         ESI

ETC…        Registers


                           EIP    ESP

                           EBP    EBX

                           EDI    ESI
    Callee frame
                          Stack   Len

                          myjmp_buf

          =
Current instruction
                                         Stack

       mov ebx, [edx+12]

                                                 Callee frame
 EIP     ESP
 EAX     EBP
                                                  Ret. From mylongjmp
 EBX     ECX

 EDX      EDI

         ESI

ETC…        Registers


                            EIP    ESP

                            EBP    EBX

                            EDI    ESI
    Callee frame
                           Stack   Len

                           myjmp_buf

          =
Current instruction
                                         Stack

       mov edi, [edx+16]

                                                 Callee frame
 EIP     ESP
 EAX     EBP
                                                  Ret. From mylongjmp
 EBX     ECX

 EDX      EDI

         ESI

ETC…        Registers


                            EIP    ESP

                            EBP    EBX

                            EDI    ESI
    Callee frame
                           Stack   Len

                           myjmp_buf

          =
Current instruction
                                         Stack

       mov esi, [edx+20]

                                                 Callee frame
 EIP     ESP
 EAX     EBP
                                                  Ret. From mylongjmp
 EBX     ECX

 EDX      EDI

         ESI

ETC…        Registers


                            EIP    ESP

                            EBP    EBX

                            EDI    ESI
    Callee frame
                           Stack   Len

                           myjmp_buf

          =
Current instruction
                                                  Stack

       jmp dword ptr [edx]

                                                          Callee frame
 EIP      ESP
 EAX      EBP
                                                           Ret. From mylongjmp
 EBX      ECX

 EDX      EDI

          ESI                  Return address from
                              corresponding setjmp.
ETC…        Registers


                              EIP    ESP

                              EBP    EBX

                              EDI    ESI
    Callee frame
                             Stack   Len

                             myjmp_buf

          =

Más contenido relacionado

Destacado

Destacado (10)

Prueba cognitiva de calculo
Prueba cognitiva de calculo Prueba cognitiva de calculo
Prueba cognitiva de calculo
 
From surfing to skating
From surfing to skatingFrom surfing to skating
From surfing to skating
 
Conferência IPA 2011 - Andrew Swan Spice
Conferência IPA 2011 - Andrew Swan SpiceConferência IPA 2011 - Andrew Swan Spice
Conferência IPA 2011 - Andrew Swan Spice
 
La prehistòria
La prehistòriaLa prehistòria
La prehistòria
 
Flexkom
FlexkomFlexkom
Flexkom
 
Cl pt 7
Cl pt 7Cl pt 7
Cl pt 7
 
Cl pt 8
Cl pt 8 Cl pt 8
Cl pt 8
 
Cl pt 5
Cl pt 5Cl pt 5
Cl pt 5
 
Cl pt 6
Cl pt 6Cl pt 6
Cl pt 6
 
Stack
StackStack
Stack
 

Último

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Neo4j
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024The Digital Insurer
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Drew Madelung
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProduct Anonymous
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...DianaGray10
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUK Journal
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationRadu Cotescu
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024The Digital Insurer
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilV3cube
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CVKhem
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesBoston Institute of Analytics
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Miguel Araújo
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoffsammart93
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?Igalia
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processorsdebabhi2
 

Último (20)

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of Brazil
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation Strategies
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 

longjmp

  • 1. Current instruction Stack call mylongjmp void _fastcall mylongjmp(myjmp_buf *, int) EIP ESP EAX EBP Ret. From mylongjmp EBX ECX ecx holds the first argument of EDX EDI mylongjmp (fastcall of MSVC) ESI ETC… Registers EIP ESP EBP EBX EDI ESI Callee frame Stack Len myjmp_buf =
  • 2. Current instruction Stack mov eax, edx eax stores return value EIP ESP EAX EBP Ret. From mylongjmp EBX ECX EDX EDI ESI ETC… Registers edx holds the second argument of mylongjmp (fastcall of MSVC) EIP ESP EBP EBX EDI ESI Callee frame Stack Len myjmp_buf =
  • 3. Current instruction Stack mov edx, ecx EIP ESP EAX EBP Ret. From mylongjmp EBX ECX EDX EDI ESI ETC… Registers EIP ESP EBP EBX EDI ESI Callee frame Stack Len myjmp_buf =
  • 4. Current instruction Stack mov esp, [edx+4] EIP ESP EAX EBP Ret. From mylongjmp EBX ECX EDX EDI ESI ETC… Registers EIP ESP EBP EBX EDI ESI Callee frame Stack Len myjmp_buf =
  • 5. Current instruction Stack mov edi, esp EIP ESP EAX EBP Ret. From mylongjmp EBX ECX EDX EDI ESI ETC… Registers EIP ESP EBP EBX EDI ESI Callee frame Stack Len myjmp_buf =
  • 6. Current instruction Stack mov esi, [edx+24] EIP ESP EAX EBP Ret. From mylongjmp EBX ECX EDX EDI ESI ETC… Registers EIP ESP EBP EBX EDI ESI Callee frame Stack Len myjmp_buf =
  • 7. Current instruction Stack mov ecx, [edx+28] EIP ESP EAX EBP Ret. From mylongjmp EBX ECX EDX EDI ESI ETC… Registers EIP ESP EBP EBX EDI ESI Callee frame Stack Len myjmp_buf =
  • 8. Current instruction Stack cld rep movsb Callee frame EIP ESP EAX EBP Ret. From mylongjmp EBX ECX EDX EDI ESI ETC… Registers EIP ESP EBP EBX EDI ESI Callee frame Stack Len myjmp_buf =
  • 9. Current instruction Stack mov ebp, [edx+8] Callee frame EIP ESP EAX EBP Ret. From mylongjmp EBX ECX EDX EDI ESI ETC… Registers EIP ESP EBP EBX EDI ESI Callee frame Stack Len myjmp_buf =
  • 10. Current instruction Stack mov ebx, [edx+12] Callee frame EIP ESP EAX EBP Ret. From mylongjmp EBX ECX EDX EDI ESI ETC… Registers EIP ESP EBP EBX EDI ESI Callee frame Stack Len myjmp_buf =
  • 11. Current instruction Stack mov edi, [edx+16] Callee frame EIP ESP EAX EBP Ret. From mylongjmp EBX ECX EDX EDI ESI ETC… Registers EIP ESP EBP EBX EDI ESI Callee frame Stack Len myjmp_buf =
  • 12. Current instruction Stack mov esi, [edx+20] Callee frame EIP ESP EAX EBP Ret. From mylongjmp EBX ECX EDX EDI ESI ETC… Registers EIP ESP EBP EBX EDI ESI Callee frame Stack Len myjmp_buf =
  • 13. Current instruction Stack jmp dword ptr [edx] Callee frame EIP ESP EAX EBP Ret. From mylongjmp EBX ECX EDX EDI ESI Return address from corresponding setjmp. ETC… Registers EIP ESP EBP EBX EDI ESI Callee frame Stack Len myjmp_buf =