All right.
So we are now in the 64 bit rock chaining section and we have a lot of things to cover to differentiate
between 64 bit and 32 bit rock chaining.
So previously we covered automated 32 bit rock Cheney on windows using immunity buggers Mona Pi module.
It was the moment where at the very end, the Windows seven virtual machine froze up because it was
actually trying to recalculate a rock chain to gain shell access.
In this section, we will introduce you to manual rock chaining on custom compile binaries on Linux
64 bit.
But when you're using rock chains or actually using 64 bit exploits, you need to pass the lower case
capital.
Q parameter meaning 64 bit little Indian.
As we all know, like the lower side means little Indian.
And it's actually stands for a double long integer or you know, in documentation it would just say
long, long int.
And we will also heavily use offsets from the standard C library file, outer space layout, randomization
protection enabled.
So there are fundamental differences between 32 bit is 64 bit rock chaining, which is why I went for
teaching for 64 bit rock chaining first 32 bit rock chain right off are actually heavily dominant online.
The main difference is that 32 bit rock chaining.
They rely on what's called a standard call and usually the gadgets are placed on a stack and they're
incremented by four bytes instead of eight.
The most notable part, about 64 bit is the calling convention, where if we use a rock chain, we must
populate the specific registers before executing our final drop gadget.
Furthermore, the stack and registers must be must be aligned with a final RET instruction, return
instruction, or the execution will fail.
And one more thing is canonical addresses.
You can actually Google Canonical addresses because in 64 bit computing, we don't actually use all
64 bits of memory address space, we actually use around 48 bits or six bytes.
So we actually have ranges of memory addresses in the stack, which is an invalid memory address.
So this is the 64 bit calling conventions, and this is just an example.
So let's say that I want to do Shell, right?
So I would first execute a drop chain to populate the RTI register with the H variable and then I would
execute sys RTI as the only argument.
So for Linux 64 bit, it can support six specified registers.
You just simply put them as arguments inside the register.
And then after the six argument, it becomes a offset from the return stack pointer in windows.
Let's say that you want to shut down virtual protect.
You would have to populate four registers and if you still need arguments.
Oh, I forgot a little parenthesis here, but if you still need a more argument you would do another
offset from the return stack pointer.