Hacker News new | ask | show | jobs
by ashkankiani 1899 days ago
Turning the JZ into a nop to fallthrough to the next line is easier, right? That might be what he did in the quickfix area anyway.

The self-marriage part was pretty hilarious. "Do I take myself? I do!"

3 comments

> The self-marriage part was pretty hilarious. "Do I take myself? I do!"

People are doing that in real life: https://www.abc.net.au/everyday/why-women-marry-themselves/1...

Of course, it isn't legally recognised anywhere. And I doubt it will be – marriage as a legal relationship between two distinct people has various legal consequences on property law, taxation law, etc – a self-married person is legally indistinguishable from an unmarried person. But no law against holding a party called a "self-marriage ceremony", if your guests are happy to attend it.

There is a very big difference between a wedding and a marriage. I don't understand why this confuses so many people, but it does.
In some languages the same word means both, e.g. the Italian “matrimonio”
Come to think of it, it seems to be the case in at least some Indian languages (ie, "wedding" & "marriage" are referred to by the same term). I can't think of a distinct native term for "marriage" as an entity or a state of being - the closest I can come up with is akin to "married" as a past tense verb.
English has wedlock.
Changing JZ into JZ to the following address has the advantage of ease of editing: same length, same opcode, reliably copied, pasted and inspected value. A NOP sequence is more general but making it the wrong length is not impossible.
NOP on x86 is one byte. Patching out an instruction with a NOP is always possible.

Further, not all jumps are equal; while you can certainly patch the assembly and let the assembler manage the variant selection and relocations etc., doing bytecode patching is a different story. You might have to change the jump instruction altogether depending on how "far" away the pointer is.

Also, jumps hold conditions in most cases (the exception being an unconditional jump, JMP) which means that you have to adhere to whatever state is expected at that point in time.

The NOP approach is usually the soundest and safest.

It's more general, but also more invasive. Replacing jumps with another jump as discussed in the article leaves part of the original intent (the test or the address) intact, while a NOP sequence leaves no indication of what it replaces.
This technique is known as a NOP sled. You have to change all the bytes in the jump to NOPs (opcode 0x90).

https://en.wikipedia.org/wiki/NOP_slide

A NOP slide is a slightly different thing.

The NOPs as suggested by GP are meant to replace unwanted instructions. The purpose of a NOP slide is to serve as target area for jumps and to guide the flow of execution to a particular adress at the end of the slide, independent of where in the NOPed range a jump was actually executed to.

I may have used that technique once or twice in Ollydbg before, but I didn't realize it had a name. Thanks for that.
OllyDbg has been discontinued but now you can use one of its spiritual successors:

- https://github.com/eteran/edb-debugger

- https://x64dbg.com/

Other tools you might like...

- https://cutter.re/

- https://github.com/longld/peda

- https://github.com/Gallopsled/pwntools

And of course, Ghidra, that means no mention.