Embedded Files
PSHUFB DST, SRC
In SRC the shuffle control mask is stored which provides the 'shuffle rule'.
SRC (shuffle control mask)
In the shuffle control mask the index positions of the original DST are given which should be reassembled to create a permutated string.
pwndbg> hexdump 0x555555558070
+0000 0x555555558070 02 06 07 01 05 0b 09 0e 03 0f 04 08 0a 0c 0d 00 │....│....│....│....│
pwndbg> hex 0x7fffffffdee0
+0000 0x7fffffffdee0 43 54 46 7b 31 32 33 34 35 36 37 38 39 30 7d 00 │CTF{│1234│5678│90}.│
After 'pshufb' was executed we can see that the value in the xmm0 register permuted our entered string using the shuffle control mask.
pwndbg> p $xmm0
$3 = {
v4_float = {3.09581736e+12, 1.51382049e+37, 6.59383375e-07, 176.223495},
v2_double = {1.4190915071935859e+295, 4566508905758843},
v16_int8 = {70, 51, 52, 84, 50, 56, 54, 125, 123, 0, 49, 53, 55, 57, 48, 67},
v8_int16 = {13126, 21556, 14386, 32054, 123, 13617, 14647, 17200},
v4_int32 = {1412707142, 2100705330, 892403835, 1127233847},
v2_int64 = {9022460692295594822, 4841432508701671547},
uint128 = 89308666438157326804141656731370664774
}
| 00 | 01 | 02 | 03 | 04 | 05 | 06 | 07 | 08 | 09 | 0A | 0B | 0C | 0D | 0E | 0F | <- IDX in hex
| 43 | 54 | 46 | 7B | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 30 | 7D | 00 | <- DST in hex
| 02 | 06 | 07 | 01 | 05 | 0B | 09 | 0E | 03 | 0F | 04 | 08 | 0A | 0C | 0D | 00 | <- SRC in hex
| 46 | 33 | 34 | 54 | 32 | 38 | 36 | 7D | 7B | 00 | 31 | 35 | 37 | 39 | 30 | 43 | <- shuffled DST in hex
| 70 | 51 | 52 | 84 | 50 | 56 | 54 | 125| 123| 0 | 49 | 53 | 55 | 57 | 48 | 67 | <- shuffled DST in decimal
| 00 | 01 | 02 | 03 | 04 | 05 | 06 | 07 | 08 | 09 | 0A | 0B | 0C | 0D | 0E | 0F | <- IDX in hex
| 46 | 33 | 34 | 54 | 32 | 38 | 36 | 7D | 7B | 00 | 31 | 35 | 37 | 39 | 30 | 43 | <- shuffled DST in hex
| ef | be | ad | de | ad | de | e1 | fe | 37 | 13 | 37 | 13 | 66 | 74 | 63 | 67 |
| 35 | f1 |
| 02 | 06 | 07 | 01 | 05 | 0b | 09 | 0e | 03 | 0f | 04 | 08 | 0a | 0c | 0d | 00 |
Google Sites
Report abuse