-
Book Overview & Buying
-
Table Of Contents
Ghidra Software Reverse-Engineering for Beginners - Second Edition
By :
In the previous chapter, we showed how Alina injects shellcode (located at the 0x004f6100 offset in Spark.exe) into the explorer.exe process. We analyzed this by simply reading the strings, which is a quick, practical approach, but we can be more accurate in our analysis. Let’s focus on some shellcode details.
When injecting code, it’s placed in a position that’s unknown at development time. As a consequence, the data can’t be accessed by using absolute addresses; instead, it must be accessed via relative positions. The shellcode retrieves the current address at runtime. In other words, it retrieves the EIP/RIP register.
The purpose of EIP in the x86 architecture (32-bit) and RIP in the x64 architecture (64-bit) is to point to the next instruction to execute, where it controls the flow of a program. It determines the next instruction to execute. In this section, we’ll focus on the...