linux - Loading raw code from C program -
i'm writing program loads , executes code file. got problem: "write" syscall not work. code loads , executes, not display text on screen.
program loads code:
#include < stdio.h > #include < stdlib.h > int main(int argc,char* argv[]) { unsigned int f_size = 0; unsigned char* code_buf = null; void (*func_call)(void) = null; if(argc < 2) { printf("usage: %s <file>\n",argv[0]); return 1; } file* fp = fopen(argv[1],"rb"); if(!fp) { printf("error while opening file: %s\n",argv[1]); return 1; } unsigned int fsize = 0; fseek(fp,0,seek_end); fsize = ftell(fp); fseek(fp,0,seek_set); if(fsize < 4) { printf("code size must > 4 bytes\n"); return 1; } code_buf = (unsigned char*) malloc(sizeof(unsigned char)*fsize); if(fread(code_buf,fsize,1,fp)<1) { printf("error while reading file: %s\n",argv[1]); free(code_buf); return 1; } func_call = (void (*)(void)) code_buf; printf("[exec] binary loaded\n" "\tfirst 2 bytes: 0x%x 0x%x\n" "\tlast 2 bytes: 0x%x 0x%x\n", code_buf[0],code_buf[1], code_buf[fsize-2],code_buf[fsize-1]); printf("[exec] starting code...\n"); (*func_call)(); printf("[exec] code executed!\n"); free(code_buf); return 0; }
code trying execute program (test.s):
.text movl $4, %eax movl $1, %ebx movl $str, %ecx movl $5, %edx int $0x80 jmp end str: .string "test\n" end: ret
here how compile it:
gcc -c test.s objcopy -o binary test.o test.bin
solved, @christoph
there working code:
.text call start str: .string "test\n" start: movl $4, %eax movl $1, %ebx pop %ecx movl $5, %edx int $0x80 ret
your approach can't work: shellcode must position-independant, code refers absolute address str
. unconditional jump can either relative or absolute: make sure relative verison (opcodes eb , e9 on x86).
see the technique of writing portable shell code more information.
Comments
Post a Comment