4

Greetings, SO.

I have some code which I've made attempts at compiling using gcc, but my attempts have been thwarted. Could anyone more versed assist me with the subject, perhaps there's something I'm missing.

I'm compiling this code on Linux Kitchen 2.6.28-15-generic #49-Ubuntu SMP Tue Aug 18 19:25:34 UTC 2009 x86_64 GNU/Linux.

int
main(void)
{
    __asm__(
            "xorq %rdx,%rdx"
            "movq $0x68732f6e69622fff, %rdx"
            "shr $0x8, %rbx"
            "push %rbx"
            "movq %rsp,%rdi"
            "xorq %rax,%rax"
            "pushq %rax"
            "pushq %rdi"
            "movq %rsp,%rsi"
            "mov $0x3b, %al"
            "syscall"
            "pushq $0x1"
            "pop %rdi"
            "pushq $0x3c"
            "pop %rax"
            "syscall"
    );

    return 0;
}

The error that is returned is:

$ gcc -o shellcode shellcode.c
shellcode.c: Assembler messages:
shellcode.c:4: Error: bad register name `%rdxmovq $0x68732f6e69622fff'

Thanks, everyone.

starblue
  • 55,348
  • 14
  • 97
  • 151
  • you can also inline your assembly (if its easier for you). See http://stackoverflow.com/questions/3139772/check-if-carry-flag-is-set/6399855#6399855. – jww Jun 19 '11 at 01:27

1 Answers1

9

You need to put newlines (\n) into your quoted inline assembly. Otherwise, it thinks that

xorq %rdx,%rdx
movq $0x68732f6e69622fff, %rdx

is really

xorq %rdx,%rdxmovq $0x68732f6e69622fff, %rdx

So the first two lines (and so on) should be more like this:

"xorq %rdx,%rdx\n"
"movq $0x68732f6e69622fff, %rdx\n"
jgottula
  • 1,346
  • 2
  • 11
  • 17
  • 1
    You can also just do semicolons: "xorq %rdx,%rdx;" will also compile. – Chris Feb 20 '11 at 07:22
  • 1
    the semicolon thing depends on your assembler - some old versions of `gas` and/or some vendor assemblers (`gcc` doesn't _have_ to use the GNU assembler) don't like it. What always works is to simply use `"` not twice per line, but only at the beginning and the end of a multi-line `asm` block. – FrankH. Jan 14 '13 at 09:28
  • 1
    Remember that to the compiler, `"abc" "xyz"` is just a fancy way to write `"abcxyz"` (quite handy when splitting up long format strings and such). The body of the `asm` is handled just like the rest of the source (unfortunately?). – vonbrand Jan 31 '13 at 14:04