I have the below assembly code global _start
section .text
_start:
jmp call
pop:
pop ecx ; ECX = address of hello
xor eax, eax ; EAX = 0
xor al, al ; EAX = 4 (int 0x80 sys_write)
inc al
inc al
inc al
inc al
xor ebx, ebx
inc ebx //Does not work inside exploit
xor edx, edx
mov dl, hellolen ; EDX = length of hello string
int 0x80
; Terminate program
xor eax, eax
inc eax //Does not work inside exploit
xor ebx, ebx ; EBX = return value of 0
int 0x80
call:
call pop
hello: db "Hello World!Ho are you!!!!!"
hellolen equ $-hello
The above code works properly and gives the proper output when run independently.
But when I take objdump of the same and if I try to run through buffer overflow I get the following issues.
Here inc al increments al value properly but inc eax or inc ebx
Could be because in the objdump it shows
inc al --> fe c0
inc ebx --> 43 //some one byte number
I also tried the following methods to update eax and ebx
xor ebx, ebx
xor bl, bl
inc bl
movsx ebx, bl
;inc ebx
But here movsx opcode is 0x0f and it does not work as I encounter null terminated string(\x0x\x0f ).
EBXis1and a sign-extend does not have any effect.MOVSXdoes not incrementEBXat all - it sign-extends its value - which is1- fromBLtoEBX, and so it does nothing, because sign-extending1just fills the upper bits with zeroes that are already there due to theXOR EBX,EBX.ELF 64-bit. The exploit you wrote is specifically for 32-bit. Your encountering odd behaviour because the instruction encoding of a 32-bit program is different than 64-bit. The instructions are being misinterpreted by the CPU and yielding odd behaviour. Let me know how you make out with theshellcode.asmexample in the other answer that usessyscall. Also note it uses-f elf64when assembling with NASM (That is important)./victim) I was unsure about anything related to the target. In that other answer I linked to you will want to work off the secondshellcode.asmexample that eliminated the 0x00(NUL bytes).If you can't use 0x0f you will have to get creative to find instructions that don't use that byte as well.