Skip to content

Instantly share code, notes, and snippets.

@slayerlab
Last active June 26, 2018 16:42
Show Gist options
  • Save slayerlab/7485cad17fff39b2ccdc8861c80d86bf to your computer and use it in GitHub Desktop.
Save slayerlab/7485cad17fff39b2ccdc8861c80d86bf to your computer and use it in GitHub Desktop.
libxml2 personal notes
root@research:~/dev# cat main.c
#include <stdio.h>
#include <libxml/parser.h>
int main(int argc, char *argv[])
{
xmlDocPtr doc;
xmlNodePtr node;
/* read xmlfile */
doc = xmlReadFile(argv[1], 0, 0);
if (!argv[1])
{
printf("[!] You input an null data: '%s'\n", argv[1]);
return -1;
}
node = xmlDocGetRootElement(doc);
if (!node)
{
puts("[!] Make sure that is a correct file.\n");
return -1;
}
return 0;
}
-------------------------- %< --------------------------
0400691 <+1>: mov 0x8(%rsi),%rdi ;align stack for the 3rd parameter, making argv[1]
;pointer points to '*filename'
0400695 <+5>: mov %rsi,%rbx ;copies data from parameter to argument
0400698 <+8>: xor %edx,%edx ;initiates the register with value zero
040069a <+10>: xor %esi,%esi ;initiates the register with value zero
callq 0x400640 <xmlReadFile@plt> ;exec function: xmlReadFile(argv[1], 0, 0)
4006a1 <+17>: cmpq $0x0,0x8(%rbx) ;knowing that $0x0 corresponds to 'null terminator'
; that is equals to 'NULL', then it is a check
;if "*argv[]" points to NULL data.
4006a6 <+22>: je 0x4006b9 <main+41> ;jump to "ret" (0x4006b9) whether is NULL
;is it looks like: if (!argv[1]) { return -1; }
4006a8 <+24>: mov %rax,%rdi ;copies the data stored in rdi (*filename) to rax
4006ab <+27>: callq 0x400650 <xmlDocGetRootElement@plt> ;exec function "xmlDocGetRootElement(rax);"
4006b0 <+32>: test %rax,%rax ;set rax to '1'(true) if rax is '0'(false), then exec next current instruction
4006b3 <+35>: je 0x4006cc <main+60> ; if rax was set to "1" jump to address 0x4006cc
; reading the libxml2 documentation, note that the function "xmlDocGetRootElement"
; has 2 behaviors defined --- from xmlsoft: "Returns: the #xmlNodePtr for the root or NULL"
; exec this 3 instructions below if rax was set to '0' -- xmlDocGetRootElement's behavior
4006b5 <+37>: xor %eax,%eax ; set eax to 0
4006b7 <+39>: pop %rbx ; remove rbx from stack
4006b8 <+40>: retq ; return eax
4006b9 <+41>: xor %esi,%esi ;reset the 32-bit LSB of the RSI register, - WORD size.
4006bb <+43>: mov $0x400868,%edi ;input the value stored in "0x40086" into EDI register.
4006c0 <+48>: xor %eax,%eax ;set EAX to '0'
4006c2 <+50>: callq 0x400630 <printf@plt> ;callq belongs to SIMD (single instruction, multiple data)
;perform the printf() execution and pushes the current address
;of instruction pointer (%rip) onto the stack and jumps to it.
; return after callq
04006c7 <+55>: or $0xffffffff,%eax ;set to '1' all bits (32-bits length)
04006ca <+58>: pop %rbx ;remove rbx from the stack
04006cb <+59>: retq ;return "-1" (0xffffffff)
; calling "puts" function with message stored at "$0x400890" and do the same thing as above and return -1
04006cc <+60>: mov $0x400890,%edi
04006d1 <+65>: callq 0x400660 <puts@plt>
04006d6 <+70>: or $0xffffffff,%eax
04006d9 <+73>: pop %rbx
04006da <+74>: retq
-------------------------- %< --------------------------
@slayerlab
Copy link
Author

Dropping this as public 2 years later.

@slayerlab
Copy link
Author

slayerlab commented Apr 16, 2018

[Warning] This note has no intention of teaching. They're just random notes and outburst during my studies two years later.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment