Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- execve syscall returning EFAULT using 32bit call conventions on 64bit AMD
- .global main
- main:
- jmp two
- one:
- # zero rax and rdx
- xor %rax,%rax
- mov %rax,%rdx
- # save string location
- mov (%rsp),%rbx
- # push argv array onto the stack
- add $16, %rsp
- push %rax
- push %rbx
- # assign argv pointer
- mov %rsp,%rcx
- # execve call
- mov $0xb, %al
- int $0x80
- # exit on failure
- xor %rax,%rax
- xor %rbx,%rbx
- movb $0x1,%al
- int $0x80
- two:
- # get address of the string
- call one
- .string "/bin/date"
- (gdb) info registers
- rax 0xb 11
- rbx 0x4000a0 4194464
- rcx 0x7fffffffe968 140737488349544
- rdx 0x0 0
- (gdb) x/s $rbx
- 0x4000a0: "/bin/date"
- (gdb) x/s *$rcx
- 0x4000a0: "/bin/date"
- .global main
- main:
- jmp two
- one:
- # zero rax and rdx
- xor %rax,%rax
- mov %rax,%rdx
- # save string location, note that %rdi is used instead of %rbx
- pop %rdi
- # push argv array onto the stack
- add $16, %rsp
- push %rax
- push %rdi
- # assign argv pointer, using %rsi instead of %rcx
- mov %rsp,%rsi
- # execve call, note that the syscall number is different than in 32bit
- mov $0x3b, %al
- syscall
- two:
- # get address of the string
- call one
- .string "/bin/date"
- int execve(const char *filename,
- char *const argv[],
- char *const envp[]);
- char *filename = "/bin/date";
- char *argv [2] = {filename, NULL};
- char *envp [1] = {NULL};
- execve (filename, argv, envp);
- char *filename = "/bin/date";
- execve (filename, NULL); // note missing third parameter, and malformed argv[]
Add Comment
Please, Sign In to add comment