CODEWITHSUNDEEP
assemblyx86reverse
S7_0
S7_0

Reputation: 1183

Why do I only need to increment for change a asm instruction using hexa editor

I'm trying to modify this program and display "it's not the same" only using objdump and a hexadecimal editor.

#include <string.h>
#include <stdio.h>

int     main(int argc, char *argv[])
{
  int   return_value;

  return_value = strcmp("test", "test");
  if (return_value == 0)
      printf("it's the same\n")
  else
      printf("it's not the same\n");
  return (1);
}

Do I used objdump -D and found the line of the JNE instruction. My first question is to know is it a JNE instruction and why not a JE ? Because JNE mean "jump not equal" however I wrote in my condition if return value IS equal to 0.

My second question is in the title, why do I need to increment for change an instruction ? (as in the following link)

How does one change an instruction with a hex editor?

  400526:       55                      push   %rbp
  400527:       48 89 e5                mov    %rsp,%rbp
  40052a:       48 83 ec 20             sub    $0x20,%rsp
  40052e:       89 7d ec                mov    %edi,-0x14(%rbp)
  400531:       48 89 75 e0             mov    %rsi,-0x20(%rbp)
  400535:       c7 45 fc 00 00 00 00    movl   $0x0,-0x4(%rbp)
  40053c:       83 7d fc 00             cmpl   $0x0,-0x4(%rbp)
  400540:       75 0c                   jne    40054e <main+0x28>
  400542:       bf e4 05 40 00          mov    $0x4005e4,%edi
  400547:       e8 b4 fe ff ff          callq  400400 <puts@plt>
  40054c:       eb 0a                   jmp    400558 <main+0x32>
  40054e:       bf f1 05 40 00          mov    $0x4005f1,%edi
  400553:       e8 a8 fe ff ff          callq  400400 <puts@plt>
  400558:       b8 01 00 00 00          mov    $0x1,%eax
  40055d:       c9                      leaveq
  40055e:       c3                      retq
  40055f:       90                      nop

I replace 75 by 76 in the hexa editor and it worked. But didn't understand why. (and by the way, what 0c corresponding to ?)

Thanks

Upvotes: 0

Views: 101

Answers (1)

Scott Hunter
Scott Hunter

Reputation: 49803

@Michael explained in a comment why/how JNE is being used.

As for the increment part of your question: it just so happens that the binary encodings (a.k.a. machine language) of your original and changed instructions are 1 apart.

Upvotes: 1

Related Questions