In reverse engineering we often need an executable binary to mapped in memory, stopped at a certain address. One approach is to modify the executable binary temporarily to jump at its own address. I have written a very small c code and compile it with optimization level 2.
#include <stdio.h>
int main(void)
{
while(1);
return 0;
}NOTE If we use for(;;) instead of while(1), we would get the same
result.
In x86 (both in 64-bit and 32 bit), you can use these two bytes : 0xEB 0xFE.
While writing in assembly we can use jmp $ for the very same purpose.
In AARCH64 we can use 0x14000000. In aarch64 assembly it is equivalent
to b .. b instruction means unconditional branch
In ARM we can use 0xeafffffe.
Below you can find PoC code and objdump output for x86_64, x86_32, AARCH64 and ARM
Compile with gcc -Wall -O2 loop.c -o loop
$ objdump -d -M intel loop-x86_64
<snipped for brevity>
0000000000001020 <main>:
1020: eb fe jmp 1020 <main>
1022: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
1029: 00 00 00
102c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
<snipped for brevity>For 32-bit executable compile with gcc -m32 -Wall -O2 loop.c -o loop-x86_32
$ objdump -d -M intel loop-x86_32
<snipped for brevity>
Disassembly of section .text:
00001050 <main>:
1050: eb fe jmp 1050 <main>
<snipped for brevity>Instead of GCC we can use ML64 on x64 Windows systems. Then
we can use dumpbin to inspect disassembly code:
dumpbin /disasm Jump2Itself2.exe
Microsoft (R) COFF/PE Dumper Version 14.36.32532.0
Copyright (C) Microsoft Corporation. All rights reserved.
Dump of file Jump2Itself2.exe
File Type: EXECUTABLE IMAGE
0000000140001000: EB FE jmp 0000000140001000
0000000140001002: C3 ret
Summary
1000 .rdata
1000 .textOn my x86_64 ArchLinux platform I have compiled with :
aarch64-linux-gnu-gcc -Wall -O2 loop.c -o loop-aarch64
$ aarch64-linux-gnu-objdump -d loop-aarch64
<snipped for brevity>
Disassembly of section .text:
0000000000000600 <main>:
600: 14000000 b 600 <main>
<snipped for brevity>On my x86_64 ArchLinux platform I have compiled with :
arm-linux-gnueabihf-gcc -Wall -O2 loop.c -o loop-arm
$ arm-linux-gnueabihf-objdump -d loop-arm
<snipped for brevity>
Disassembly of section .text:
000003d0 <main>:
3d0: eafffffe b 3d0 <main>
<snipped for brevity><snipped for brevity>
Disassembly of section .text:
00400090 <__start>:
400090: 1000ffff b 400090 <__start>
400094: 00000000 nop
00400098 <__exit>:
400098: 24040001 li a0,1
40009c: 24020fa1 li v0,4001
4000a0: 0000000c syscall