Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- [bits 32]
- ; the following is 61 bytes when assembled
- push byte 0x4 ; 0x4 == sys_write
- pop eax ;
- lea edx, [eax + eax*2] ; string length to print == 12
- push byte 0x1 ; where to write, 0x1 == stdout
- jmp SHORT data_segment
- _databack:
- ; first time here pops pointer to mystr
- ; 2nd time pops pointer pointer argv
- pop ecx
- ; first time here pops 0x1
- ; 2nd time pops pointer argv[0]
- pop ebx;
- int 0x80 ; execute syscall
- cdq ; zero edx
- push edx ; zero terminate argv
- lea ecx, [ecx+2*eax]; point to arg1 str
- push ecx ; arg1
- dec ecx ; point to end of previous string
- mov [ecx],dl ; zero terminate arg0
- dec eax ; eax holds returnvalue of 12 (length of str printet)
- sub ecx, eax ; point to beginning of arg0
- push ecx ; arg0
- push esp ; esp is a pointer pointer to argv
- jmp SHORT _databack
- data_segment:
- call _databack ; trampoline
- mystr db "hello world",0xa,"/usr/bin/id -u"
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement