[英]self-modifying under windows issue overwrite
I am writting a self-mutation code , and its original value before overwrite is 1
,but after the overwrite should be 42
.我在写一个自变异代码,覆盖前它的原始值为1
,但覆盖后应该是42
。 I think I am missing some aspecs because I got 1
on both original and mutation overwrite.我想我错过了一些方面,因为我在原始和突变覆盖上都得到了1
。 my complete code looks like this gist link , but the original source was written under *unix https://shanetully.com/2013/12/writing-a-self-mutating-x86_64-c-program/我的完整代码看起来像这个要点链接,但原始源代码是在 *unix https://shanetully.com/2013/12/writing-a-self-mutating-x86_64-c-program/下编写的
#include <windows.h>
#include <iostream>
using namespace std;
int getpagesize();
void foo(void);
int change_page_permissions_of_address(void *addr);
int getpagesize() {
SYSTEM_INFO si;
GetSystemInfo(&si);
return unsigned(si.dwPageSize);
}
void foo(void) {
int i = 0;
i++;
printf("i: %d\n", i);
}
int change_page_permissions_of_address(void *addr) {
// Get total function size
int page_size = getpagesize();
DWORD dwOldProtect;
// Obtain the addresses for the functions so we can calculate size.
uintptr_t tmp = (uintptr_t)addr-(uintptr_t)addr%page_size;
addr = (void*)tmp;
// We need to give ourselves access to modifify data at the given address
if (VirtualProtect(addr, page_size, PAGE_EXECUTE_READWRITE, &dwOldProtect) == -1) {
return -1;
}
return 0;
}
int main() {
void *foo_addr = (void*)foo;
if (change_page_permissions_of_address(foo_addr) == -1) {
printf("Error while changing page permissions of foo(): %s\n");
return 1;
}
// Call the unmodified foo()
puts("Calling foo...");
foo();
// Change the immediate value in the addl instruction in foo() to 42
unsigned char *instruction = (unsigned char*)foo_addr + 18;
*instruction = 0x2A;
puts("Calling foo..., but I am the self-modifying");
foo();
cin.get();
return 0;
}
Check of VirtualProtect
is incorrect as it returns FALSE
, not -1 in case of an error. VirtualProtect
检查不正确,因为它返回FALSE
,而不是 -1 以防出错。 Also I suspect that you will need to obtain a pointer to a starting page of the region of pages that foo
belongs to and it is not clear where did you get offset 18
from.此外,我怀疑您将需要获取指向foo
所属页面区域起始页的指针,目前尚不清楚您从何处获得偏移量18
。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.