my mistake...

short jump:
it's JMP_Address + 2 + Second_Byte_value = Next_Instruction_Address

[EMAIL PROTECTED]:~/tmp$ echo -n -e "\x75\x65" > a
[EMAIL PROTECTED]:~/tmp$ ndisasm -b32 a
00000000  7565              jnz 0x67
[EMAIL PROTECTED]:~/tmp$ ~/instalar/libdisassemble/disassemble.py a 0x0 0xff
Disassembling file a at offset: 0x0
 00000000:   jnz           0x65

this is where my mistake came from ;)
thnx

On Fri, 7 Jan 2005 13:30:21 -0300, shadown <[EMAIL PROTECTED]> wrote:
> Hi,
> 
> not a vulnerability but could be a headache while reverse ingineering
> or binary auditing/interpreting, etc. (ok anything related with
> disassembling)
> get wrong values.
> 
> [EMAIL PROTECTED]:/tmp$ ndisasm -b32 salida
> 00000000 49 dec ecx
> 00000001 6E outsb
> 00000002 7465 jz 0x69
> 00000004 6C insb
> 00000005 6563747561 arpl [gs:ebp+esi*2+0x61],si
> 0000000A 6C insb
> 0000000B 207072 and [eax+0x72],dh
> 0000000E 6F outsd
> 0000000F 7065 jo 0x76
> 00000011 7274 jc 0x87
> 00000013 7920 jns 0x35
> 00000015 6F outsd
> 00000016 66204968 o16 and [ecx+0x68],cl
> 0000001A 61 popa
> 0000001B 51 push ecx
> 0000001C 7565 jnz 0x83
> 0000001E 52 push edx
> 0000001F 00 db 0x00
> [EMAIL PROTECTED]:/tmp$ ndisasm -V
> NDISASM version 0.98.38 compiled Jan 7 2005
> [EMAIL PROTECTED]:/tmp$
> 
> i.e:
> 0000001C 7565 jnz 0x83
> sould had been jnz 0x65
> 
> I've just tested ndisasm 0.98.36 and 0.98.38
> 
> cheers.
> shadown
> --
> Sergio Alvarez
> Security, Research & Development
> IT Security Consultant
> email: [EMAIL PROTECTED]
> 
> This message is confidential. It may also contain information that is
> privileged or otherwise legally exempt from disclosure. If you have
> received it by mistake please let us know by e-mail immediately and
> delete it from your system; should also not copy the message nor
> disclose its contents to anyone. Many thanks.
> 


-- 
Sergio Alvarez
Security, Research & Development
IT Security Consultant
email: [EMAIL PROTECTED]

This message is confidential. It may also contain information that is
privileged or otherwise legally exempt from disclosure. If you have
received it by mistake please let us know by e-mail immediately and
delete it from your system; should also not copy the message nor
disclose its contents to anyone. Many thanks.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Reply via email to