Part 17 - Hacking Float Primitive Datatype

For a complete table of contents of all the lessons please click below as it will give you a brief of each lesson in addition to the topics it will cover. https://github.com/mytechnotalent/hacking\_c-\_arm64

Today we hack the float from the last lesson.

First update our radare2 source code.

  1. cd radare2
  2. git pull
  3. sys/user.sh

If you did not follow the instructions earlier you have to build radare2 from source for this to work as they rarely update releases.

https://github.com/radareorg/radare2

If you do not have the repo, clone it and follow the instructions above.

Let’s fire up radare2 in write mode.

  1. radare2 -w ./0x05_asm64_float_primitive_datatype

Let’s auto analyze.

  1. aaa

Seek to main.

  1. s main

View disassembly.

  1. v

Let’s get back to the terminal view.

  1. q

We need to hack two instructions here. Let’s examine two very specific instructions.

  1. movz w0, 0x999a
  2. movk w0, 0x4121, lsl 16

Remember from last week that ultimately w0 is going to hold 0x4121999a as the lsl moves the bites in reverse byte order.

Currently this will produce a float of 10.1 as we have seen in the prior lessons. It is critical that you understand that in floating-point numbers there is a mantissa which in our case is 10 and an exponent which is the 1 to which they are separated by a . which ties them together.

Therefore to get 10.2 we would need to write assembly and update these instructions.

  1. [0x000009b4]> wa movz w0, 0x3333 @0x000009bc
  2. [0x000009b4]> wa movk w0, 0x4123, lsl 16 @0x000009c0
  3. q

Now run the binary!

  1. kali@kali:~/Documents/0x05_float_primitive_datatype$ ./0x05_float_primitive_datatype
  2. 10.2

I want you to take a close look at some examples I have put together for you so that you can understand how different values result in different results. Keep in mind these results are in an active debug session so the addresses will be different so your ASLR will have different values.

  1. [0x555e6c29c4]> dr w0 = 0x4122999a
  2. 0x4121999a ->0x4122999a
  3. [0x555e6c29c4]> dc
  4. hit breakpoint at: 0x555e6c29c8
  5. [0x555e6c29c8]> dc
  6. 10.1625
  7. (238252) Process exited with status=0x0
  9. [0x556215e9c4]> dr w0 = 0x41235555
  10. 0x4121999a ->0x41235555
  11. [0x556215e9c4]> dc
  12. hit breakpoint at: 0x556215e9c8
  13. [0x556215e9c8]> dc
  14. 10.2083
  15. (238258) Process exited with status=0x0
  17. [0x558216c9c4]> dr w0 = 0x4123599a
  18. 0x4121999a ->0x4123599a
  19. [0x558216c9c4]> dc
  20. hit breakpoint at: 0x558216c9c8
  21. [0x558216c9c8]> dc
  22. 10.2094
  23. (238257) Process exited with status=0x0
  25. [0x55868a79c4]> dr w0 = 0x4123999a
  26. 0x4121999a ->0x4123999a
  27. [0x55868a79c4]> dc
  28. hit breakpoint at: 0x55868a79c8
  29. [0x55868a79c8]> dc
  30. 10.225
  31. (238253) Process exited with status=0x0
  33. [0x55826479c4]> dr w0 = 0x41233333
  34. 0x4121999a ->0x41233333
  35. [0x55826479c4]> dc
  36. hit breakpoint at: 0x55826479c8
  37. [0x55826479c8]> dc
  38. 10.2
  39. (238259) Process exited with status=0x0
  41. [0x55716ab9c4]> dr w0 = 0x4125999a
  42. 0x4121999a ->0x4125999a
  43. [0x55716ab9c4]> dc
  44. hit breakpoint at: 0x55716ab9c8
  45. [0x55716ab9c8]> dc
  46. 10.35
  47. (238250) Process exited with status=0x0
  49. [0x55880169c4]> dr w0 = 0x412f999f
  50. 0x4121999a ->0x412f999f
  51. [0x55880169c4]> dc
  52. hit breakpoint at: 0x55880169c8
  53. [0x55880169c8]> dc
  54. 10.975
  55. (238245) Process exited with status=0x0
  57. [0x559130d9c4]> dr w0 = 0x412ff99e
  58. 0x4121999a ->0x412ff99e
  59. [0x559130d9c4]> dc
  60. hit breakpoint at: 0x559130d9c8
  61. [0x559130d9c8]> dc
  62. 10.9984
  63. (238246) Process exited with status=0x0
  65. [0x557b1b39c4]> dr w0 = 0x412fff9e
  66. 0x4121999a ->0x412fff9e
  67. [0x557b1b39c4]> dc
  68. hit breakpoint at: 0x557b1b39c8
  69. [0x557b1b39c8]> dc
  70. 10.9999
  71. (238247) Process exited with status=0x0
  73. [0x55931439c4]> dr w0 = 0x412ffffe
  74. 0x4121999a ->0x412ffffe
  75. [0x55931439c4]> dc
  76. hit breakpoint at: 0x55931439c8
  77. [0x55931439c8]> dc
  78. 11
  79. (238248) Process exited with status=0x0

You can start to see patterns here. TAKE THE TIME AND ACTUALLY TRY THESE OUT so you have a better understand of how these values ultimately go into the s0 register!

Next lesson we will discuss doubles.