I have just started learning about Assembly Language. After gaining some basic knowledge I am trying to write some simple shellcode. Here is the given programme by which I am trying to simply print the "Hello, World!" text.
root@localhost:~/assembly/x86_64# cat jmpcallhello.nasm
global _start
section .text
_start:
jmp call_shellcode
shellcode:
pop rsi
xor rax, rax
mov al, 1
xor rdi,rdi
mov dil,1
mov rdx, rdi
add rdx, 13
syscall
xor rax, rax
mov al, 60
xor rdi, rdi
syscall
call_shellcode:
call shellcode
tset: db "Hello, World!",0xa
root@localhost:~/assembly/x86_64#
Then I created the object and binary file.
root@localhost:~/assembly/x86_64# nasm -f elf64 jmpcallhello.nasm -o jmpcallhello.o
root@localhost:~/assembly/x86_64# ld jmpcallhello.o -o jmpcallhello
root@localhost:~/assembly/x86_64# file jmpcallhello
jmpcallhello: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
When I try to execute it, works perfectly.
root@localhost:~/assembly/x86_64# ./jmpcallhello
Hello, World!
But the problem comes when I tried to execute it with its objdump code.
Here is the objdump output:
root@localhost:~/assembly/x86_64# objdump -M intel -d jmpcallhello
jmpcallhello: file format elf64-x86-64
Disassembly of section .text:
0000000000401000 <_start>:
401000: eb 1f jmp 401021 <call_shellcode>
0000000000401002 <shellcode>:
401002: 5e pop rsi
401003: 48 31 c0 xor rax,rax
401006: b0 01 mov al,0x1
401008: 48 31 ff xor rdi,rdi
40100b: 40 b7 01 mov dil,0x1
40100e: 48 89 fa mov rdx,rdi
401011: 48 83 c2 0d add rdx,0xd
401015: 0f 05 syscall
401017: 48 31 c0 xor rax,rax
40101a: b0 3c mov al,0x3c
40101c: 48 31 ff xor rdi,rdi
40101f: 0f 05 syscall
0000000000401021 <call_shellcode>:
401021: e8 dc ff ff ff call 401002 <shellcode>
0000000000401026 <tset>:
401026: 48 rex.W
401027: 65 6c gs ins BYTE PTR es:[rdi],dx
401029: 6c ins BYTE PTR es:[rdi],dx
40102a: 6f outs dx,DWORD PTR ds:[rsi]
40102b: 2c 20 sub al,0x20
40102d: 57 push rdi
40102e: 6f outs dx,DWORD PTR ds:[rsi]
40102f: 72 6c jb 40109d <tset+0x77>
401031: 64 21 0a and DWORD PTR fs:[rdx],ecx
root@localhost:~/assembly/x86_64# for i in $(objdump -d jmpcallhello |grep "^ " |cut -f2); do echo -n '\x'$i; done; echo
\xeb\x1f\x5e\x48\x31\xc0\xb0\x01\x48\x31\xff\x40\xb7\x01\x48\x89\xfa\x48\x83\xc2\x0d\x0f\x05\x48\x31\xc0\xb0\x3c\x48\x31\xff\x0f\x05\xe8\xdc\xff\xff\xff\x48\x65\x6c\x6c\x6f\x2c\x20\x57\x6f\x72\x6c\x64\x21\x0a
Here I can't see any bad character. Then I used this shellcode in this c file.
#include<stdio.h>
#include<string.h>
unsigned char code[] = \
"\xeb\x1f\x5e\x48\x31\xc0\xb0\x01\x48\x31\xff\x40\xb7\x01\x48\x89\xfa\x48\x83\xc2\x0d\x0f\x05\x48\x31\xc0\xb0\x3c\x48\x31\xff\x0f\x05\xe8\xdc\xff\xff\xff\x48\x65\x6c\x6c\x6f\x2c\x20\x57\x6f\x72\x6c\x64\x21\x0a";
int main()
{
printf("Shellcode Length: %d\n", (int)strlen(code));
int (*ret)() = (int(*)())code;
ret();
}
Then compiled it by gcc.
root@localhost:~/assembly/x86_64# gcc -fno-stack-protector -z execstack shellcode.c -o jmpcallshell
root@localhost:~/assembly/x86_64# file jmpcallshell
jmpcallshell: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=b698c45d6f4fb5c94e58369ba677b1483e66f512, for GNU/Linux 3.2.0, not stripped
But when I try to run it. It says segmentation fault.
root@localhost:~/assembly/x86_64# ./jmpcallshell
Shellcode Length: 52
Segmentation fault
root@localhost:~/assembly/x86_64#
What's the problem here? Thanks in advance.