Comments on: isX64 Gem

By: hatter

hatter — Sun, 01 Jul 2012 09:08:03 +0000

Nice trick! Good for binary – if you need an alphanumeric one, check this out http://www.blackhatlibrary.net/Architecture_detection_shellcode – mind if I add your method to our shellcode page(s)?

By: Brundle Lab | The result could be different as expected

Brundle Lab | The result could be different as expected — Sun, 29 Apr 2012 19:55:09 +0000

[...] NOTE: This difference in the opcode translation is leveraged in a very neat trick in order to make your shellcode architecture independent. Read more here. [...]

By: Noobieboobie

Noobieboobie — Wed, 28 Sep 2011 13:10:56 +0000

Sounds cool, but i have some questions. (i’m pretty new to low-level fun)

How do you assemble this code? Can you decide to which instruction set it’s assembled? How can you write to 2 different instruction sets in one code?

It would make sense to me to also put the isX64 part under ‘bits 32′, is it?

Your blog is incredible, i wish you would update more frequently!
Thank you

By: SkyLined

SkyLined — Sun, 21 Aug 2011 22:15:20 +0000

Nice trick, thanks for sharing!

I’ve recently rewritten my x86 Windows shellcode that executes calc.exe on all versions of Windows, on all Service Packs using tips from Peter Ferrie. I created a x64 version as well and, using this trick, I created one shellcode that runs on all versions, Service Packs and architectures (x86 and x64) of Windows. See http://code.google.com/p/win-exec-calc-shellcode/ for source and binaries.

By: Peter Ferrie

Peter Ferrie — Sat, 16 Jul 2011 03:31:39 +0000

Yes, Ange used that trick in another context, but using it here would end up being longer than Arkon’s version because you’d need an explicit test afterwards.

By: Myria

Myria — Thu, 14 Jul 2011 00:20:40 +0000

A similar trick might also work with the “ARPL” “MOVSXD” instructions.

By: ziggz

ziggz — Wed, 13 Jul 2011 23:58:21 +0000

neat trick!

By: arkon

arkon — Wed, 13 Jul 2011 21:28:57 +0000

push cs; pop ax would work (0×23 and 0×33), but my code is platform independent.

By: Myria

Myria — Wed, 13 Jul 2011 21:24:41 +0000

@Ange
Well, if you’re willing to hardcode the expected segment values, yes. There are other ways, like using the “lar” instruction on the CS selector and checking for the “long” bit.

By: Ange

Ange — Wed, 13 Jul 2011 21:16:35 +0000

(didn’t test) can’t CS value tell you the answer directly btw ?