0
_start:
    jmp short call

shell:
    pop esi
    movsd ;move 4 byte from esi to edi (/bin)
    mov edx,edi ;edx contains /bin
    xor edi,edi 
    movsw ;move 2 bytes (/s) 
    xor ebx,ebx
    mov ebx,edi ;ebx contains /s
    xor eax,eax
    xor edi,edi
    movsb
    mov eax,edi ;eax contiene h
    mov esi,edx ;esi contains /bin

    xor ecx,ecx
    push ecx
    mov edx,esp ;edx dword NULL

    push ecx ;NULL
    push ecx ;NULL
    add esp,3 ;0
    push eax
    add esp,3 ;h
    push ebx
    add esp,2 ;/s
    push esi ;/bin  
    mov ecx,esp ;/bin/sh0,NULL

    xor edi,edi
    push edi
    add esp,3 ;0
    push eax
    add esp,3
    push ebx
    add esp,2
    push esi
    mov ebx,esp ;/bin/bash0

    xor eax,eax
    mov al,0xb
    int 0x80

call:
    call shell
    path db "/bin/sh"

i'm trying to write a shellcode (jmp-call-pop) that spawn a shell but i got a problem on the movsd instruction (segfault). I don't understand what is wrong, i setup esi with the ptr to the string so movsd should move 4 byte from esi to edi right? But why it is segfaulting?

1 Answer 1

2

movsd moves 4 bytes from the memory pointed to by esi to the memory pointed to by edi. You haven’t initialized edi, so this is a store to an arbitrary address; it’s not terribly surprising that it happens to segfault.

Intel’s Architecture Manual, Volume 2 (These are a free download and can answer all of your basic assembly questions. Download them and familiarize yourself with where to find things if you’re going to be writing assembly):

Moves the byte, word, or doubleword specified with the second operand (source operand) to the location specified with the first operand (destination operand). Both the source and destination operands are located in memory.

4
  • lea edi,[edx] give me segfault! But i am initializing edi with the address of edx...am i right?
    – polslinux
    Feb 17, 2014 at 16:48
  • There is no such thing as the “address of edx”; lea edi, [edx] is equivalent to mov edi, edx, which doesn’t help because edx is also uninitialized. You would do well to take some time to familiarize yourself with the basics of x86 assembly. Feb 17, 2014 at 16:53
  • tell me if i am right: i cannot save the 4 byte of string directly to the register right? I have to use a buffer inside the .bss section...or not?
    – polslinux
    Feb 17, 2014 at 18:04
  • If you just want to get the memory pointed to by esi into a register, the correct way to do that is with a load (e.g. mov edx, [esi]). Definitely download the Intel manuals though; reading them will be a lot faster than trying out every possible combination of instructions =) Feb 17, 2014 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.