Advertisement
Guest User

Untitled

a guest
May 14th, 2013
118
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. [bits 32]
  2.    
  3.     ; In both parts of the exercise I have chosen to use the stack for storing the needed strings, since I found that it results in the shortest (65 bytes) and most easily readable (no weird jumps needed) code.
  4.    
  5.    
  6.     ;;; Print 'Hello, world\n' using the write syscall ;;;
  7.    
  8.     ; set syscall number
  9.     push byte 0x4
  10.     pop eax
  11.    
  12.     ; set file handle. 1 is stdout
  13.     xor ebx, ebx
  14.     inc ebx
  15.    
  16.     ; push string to stack
  17.     push byte 0x0a ; '\n'
  18.     push dword 'orld'
  19.     push dword 'o, w'
  20.     push dword 'Hell'
  21.     ; set argument to point at the string
  22.     mov ecx, esp
  23.    
  24.     ; set the length parameter
  25.     cdq ; sign-extend eax, which is 4, into edx, zeroing it
  26.     mov dl, 13
  27.    
  28.     ; and go!
  29.     int 0x80
  30.    
  31.    
  32.     ;;; Execute '/usr/bin/id' with argument '-d' using the execve syscall ;;;
  33.    
  34.     ; clear edx. it needs to be 0 later, and it's useful to have a 0.
  35.     ; note that eax contains the return code from the write syscall, which is 0
  36.     cdq ; sign-extend eax into edx
  37.    
  38.     ; set syscall number
  39.     ; xor eax, eax ; eax is already zero (return code from write syscall)
  40.     mov byte al, 11
  41.    
  42.     ; prepare filename argument
  43.     push byte 'd'
  44.     push word '/i'
  45.     push dword '/bin'
  46.     push dword '/usr'
  47.     ; set filename argument
  48.     mov ebx, esp
  49.    
  50.     ; prepare the argv argument
  51.     push edx ; terminator for argument string
  52.     push word 0x752d ; argument string: '-u'
  53.     mov esi, esp ; pointer to '-u'
  54.     ; push the argv arguments to stack
  55.     push edx ; push null terminator
  56.     push esi ; push pointer to '-u'
  57.     push ebx ; push pointer to '/usr/bin/id'
  58.     ; set argv argument
  59.     mov ecx, esp
  60.    
  61.     ; set the envp argument to null
  62.     ; xor edx, edx ; this was already done earlier
  63.    
  64.     ; ok, go!
  65.     int 0x80
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement