Skip to content

fix: resolve signature collision using body pattern and backtracking #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rbtt wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix: resolve signature collision using body pattern and backtracking #9

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4d0e582
update pattern length and enhance backwards loop for signature scanning
NikolaStanchev28 Jul 10, 2026
bc8f58c
fix for aug 25 update
NikolaStanchev28 Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 53 additions & 9 deletions main.s
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,8 @@
# CONSTS

.equ BYTES_TO_READ, 1024
.equ PATTERN_LEN, 7
.equ SCAN_ADVANCE, 960
.equ PATTERN_LEN, 11
.equ BYTE_TO_WRITE, 0xc3

_start:
Expand Down Expand Up @@ -338,6 +339,7 @@ strcmp_file:
loop strcmp_file

found_file:
movq $0, end_addr
lea start_addr_buff, %r12
lea start_addr, %r13
mov $0, %r14
Expand Down Expand Up @@ -377,15 +379,15 @@ done_converting:
lea end_addr, %r13
mov $0, %r14

cmpq $0, %r13
cmpq $0, (%r13)
je convert_addr

movq start_addr, %r12
movq end_addr, %r13

loop_addr_range:
cmpq %r12, %r13
je clear_line
jbe clear_line

read_mem:
subq $32, %rsp
Expand Down Expand Up @@ -430,7 +432,7 @@ loop_read_mem:
sig_scan:
movq sig_scan_cnt, %rax

cmp $PATTERN_LEN - 1, %rax
cmp $PATTERN_LEN, %rax
je found_match


Expand All @@ -453,7 +455,32 @@ sig_scan:
jmp sig_scan

found_match:
addq loop_read_mem_cnt, %r12
movq loop_read_mem_cnt, %rax

backwards_loop:
decq %rax
cmpq $0, %rax
jl failed_match

leaq mem_read_buff(%rip), %rbp
addq %rax, %rbp

cmpb $0x31, 0(%rbp)
jne backwards_loop
cmpb $0xc0, 1(%rbp)
jne backwards_loop
cmpb $0x48, 2(%rbp)
jne backwards_loop
cmpb $0x85, 3(%rbp)
jne backwards_loop
cmpb $0xf6, 4(%rbp)
jne backwards_loop
cmpb $0x0f, 5(%rbp)
jne backwards_loop
cmpb $0x84, 6(%rbp)
jne backwards_loop

addq %rax, %r12
addq $2, %r12

jmp write_mem
Expand All @@ -463,7 +490,7 @@ failed_match:
jmp loop_read_mem

continue_loop_addr_range:
addq $1024, %r12
addq $SCAN_ADVANCE, %r12
jmp loop_addr_range

write_mem:
Expand Down Expand Up @@ -537,15 +564,29 @@ write_mem:
mov $patched_msg_len, %rdx
syscall

exit:
mov $SYS_CLOSE, %rax
mov maps_fd, %rdi
syscall

mov $SYS_EXIT, %rax
mov $SYS_EXIT, %rax
mov $0, %rdi
syscall

exit:
mov $SYS_WRITE, %rax
mov $1, %rdi
mov $not_found_msg, %rsi
mov $not_found_msg_len, %rdx
syscall

mov $SYS_CLOSE, %rax
mov maps_fd, %rdi
syscall

mov $SYS_EXIT, %rax
mov $1, %rdi
syscall

.bss
dirent_buff: .space 8129
cmdline_buff: .space 512
Expand Down Expand Up @@ -575,7 +616,7 @@ exit:

read_word: .quad 0

pattern_bytes: .byte 49, 192, 72, 133, 246, 15, 132
pattern_bytes: .byte 199, 69, 212, 255, 255, 255, 255, 199, 69, 216, 255

proc_dir: .asciz "/proc"
maps_file: .asciz "maps"
Expand All @@ -591,3 +632,6 @@ exit:

patched_msg: .asciz "Patched!\n"
patched_msg_len =.- patched_msg

not_found_msg: .asciz "Pattern not found!\n"
not_found_msg_len =.- not_found_msg