CodeCave in x64

[RAMPage]

Hello, I did 12 years ago redirecting the flow of execution was easy on a 32bit PE Executable, Change EP, to the code cave saving registers status executing code and then restoring them. In x64 i searching the way to.

hxxs://www.codeproject.com/Articles/20240/The-Beginners-Guide-to-Codecaves

The way to clear the registers, how I do this in x64? I was seeing PUSHAD and PUSHFD isnt in x64. Should I have to PUSH all registers and pop them off in x64?

x32

PUSHAD
PUSHFD
<CODE>
POPAD
POPFD
JMP Original Entry Point

Thanks

[chessgod101]

Should I have to PUSH all registers and pop them off in x64?

Yes. PUSHAD is not supported in x64, unfortunately. However, you could simply PUSH only the registers you are using in your cave to minimize size depending on your requirements.

Intel x86/x64 assembly reference:

https://cdrdv2-public.intel.com/774494/325462-sdm-vol-1-2abcd-3abcd.pdf

[RAMPage]

Thanks @chessgod101 for your reply. So I have to try this but , reading some of intel arch manual,

PUSH RAX-R15 > PUSHAD
PUSHFQ > PUSHFD
<<Shellcode>>
POP RAX - R15
POPFQ

?

Where can I start learning Assembly and coding by practice?

And always, Thanks.

[blue_devil]

Originally Posted by RAMPage

<snipped>

Where can I start learning Assembly and coding by practice?

And always, Thanks.

RAMPage, if you are new or 0 to INTEL's x86 architecture assembly, I can suggest you this book:

http://www.egr.unlv.edu/~ed/assembly64.pdf

This is an ebook, and didn't published. And It covers 64bit architecture, pretty updated!

[RAMPage]

Originally Posted by blue_devil

RAMPage, if you are new or 0 to INTEL's x86 architecture assembly, I can suggest you this book:



This is an ebook, and didn't published. And It covers 64bit architecture, pretty updated!

Thanks for sharing, I will have fun with this when I have some free time, Im in the need of putting my knowledge at practice, and this book im seeing it has quizes , so I appreciate it.

[blue_devil]

@RAMPage, In the context of "code caves" I have found this piece of art from the depths of internet; you are welcome my friend:

hXXps://legend.octopuslabs.io/archives/2390/2390.htm

[RAMPage]

Originally Posted by blue_devil

@RAMPage, In the context of "code caves" I have found this piece of art from the depths of internet; you are welcome my friend:

Friend thats a great post, I really enjoy it.

What I was saying is something like this:

hxxs://dl.packetstormsecurity.net/papers/general/manual-backdooring.pdf

Now I will try to this in x64 with ASLR.:

[Stingered]

Another example from the Interneto:

hxxps://pastebin.com/34xCSrL2

[vitriol]

Did something like this just recently with a friend.
We added a Section to the PE and patched the entry point with a jump to our entry code.
In case youre interested, the code is easy to read you can find it on my friends github;
https://github.com/XaFF-XaFF/CaveCarver

[RAMPage]

Originally Posted by vitriol

Did something like this just recently with a friend.
We added a Section to the PE and patched the entry point with a jump to our entry code.
In case youre interested, the code is easy to read you can find it on my friends github;
https://github.com/XaFF-XaFF/CaveCarver

Didnt have the chance to see it , too much things in the house to do. Im looking foward to finishing this work , I have to see how to disable ASLR in a binary too

[bolo2002]

Originally Posted by blue_devil

@RAMPage, In the context of "code caves" I have found this piece of art from the depths of internet; you are welcome my friend:

i'm still amazed that blogs like this are still alive with good tutorials,at those time,what happen to the author since 2012 is another question..

[blue_devil]

Originally Posted by bolo2002

i'm still amazed that blogs like this are still alive with good tutorials,at those time,what happen to the author since 2012 is another question..

I feel the same bolo2002! That's why I am trying to archive these kind of gems to webarchive. BTW, unfortunately I cannot access other tutorials of octopuslabs, they were somehow gone, but the link I have shared is working.

[MarcElBichon]

Originally Posted by blue_devil

BTW, unfortunately I cannot access other tutorials of octopuslabs, they were somehow gone, but the link I have shared is working.

hXXps://legend.octopuslabs.io/sample-page.html

[bolo2002]

Originally Posted by MarcElBichon

hXXps://legend.octopuslabs.io/sample-page.html

too late all is said

[bolo2002]

https://www.mirrored.to/files/INNBTOA9/flumy.zip_links