Sex with Strings
Posted: Sun Jan 05, 2014 9:48 pm
Today's discovery is ... Sex with strings for BASIC82/83
OK, the BASIC82/3 manual states that strings can only be 32 bytes long. This isn't actually true, you can concatenate strings up to 75 bytes for printing.
However, there's a darker, sexier side to our concatenated strings ... they don't like vector tables
Here's some code to demonstrate
Here we create three strings, A$, B$ and C$. By concatenating them so that each new string is twice as long - we fool BASIC 82/83 into making a string longer than 128 bytes!
Note that the character MUST be a plus sign.
This sexy exploit works by overloading the lookup for the function table at $A77A. "+" in hex is $2B - and that's the magical offset!
BASIC 82/83 does not check the bounds of X, so we tell it to happily RTS to $3AA !!!
Let the ASM in BASIC begin!
I'd appreciate someone with a real CV letting me know if this works on it - I see no reason it should not!
The DATA statement contains this asm:
OK, the BASIC82/3 manual states that strings can only be 32 bytes long. This isn't actually true, you can concatenate strings up to 75 bytes for printing.
However, there's a darker, sexier side to our concatenated strings ... they don't like vector tables
Here's some code to demonstrate
Code: Select all
10 REM ********************
20 REM * SEX WITH STRINGS *
30 REM ********************
40 REM
50 REM STEP 1. CREATE A$
60 A$="++++++++++++++++++++++++++++++++++++++++"
70 REM
80 REM STEP 2. CREATE B$ TWICE A$
90 B$=A$+A$
100 REM
110 REM STEP 3. CREATE C$ TWICE B$
120 C$=B$+B$
130 REM
140 REM THE TRAP IS SET ...
150 REM
160 REM LET'S PUT SOME ASM AT $3AA
170 REM
180 DATA 32,56,254,76,22,169
190 FORA=0TO5
200 READ B
210 POKE 938+A,B
220 NEXT
230 REM
240 REM FINALLY - LET'S RUN THE ASM!
250 PRINTLEN(C$)
260 CLS
270 PRINT
280 PRINT TAB(11);"=>?@[\]^_"
290 GOTO 280
Note that the character MUST be a plus sign.
This sexy exploit works by overloading the lookup for the function table at $A77A. "+" in hex is $2B - and that's the magical offset!
BASIC 82/83 does not check the bounds of X, so we tell it to happily RTS to $3AA !!!
Let the ASM in BASIC begin!
I'd appreciate someone with a real CV letting me know if this works on it - I see no reason it should not!
The DATA statement contains this asm:
Code: Select all
03AA: jsr $FE38 ; ROM Reload Original Character Set
03AD: jmp $A916 ; BASIC Continue to next code line
