NASM - The Netwide Assembler

NASM Forum => Programming with NASM => Topic started by: melviii100 on June 30, 2014, 09:14:28 AM

Title: Segmentation fault in - mov byte [esi + 7], al
Post by: melviii100 on June 30, 2014, 09:14:28 AM

i am studying shellcode writing. So to spawn a shell i wrote the following program

Code: [Select]

segment .text
global _start:
_start:
jmp short GotoCall

shellcode:
pop esi
xor eax, eax
mov byte [esi + 7], al          #here i get Error
lea ebx, [esi]
mov long [esi + 8], ebx
mov long [esi + 12], eax

mov byte al, 0x0b
mov ebx, esi
lea ecx, [esi + 8]
lea edx, [esi + 12]
int 80h

GotoCall:
call shellcode
Db '/bin/shJAAAABBBB'Compiled -> nasm -ggdb -f elf Shellcode_Execve.asm
Linked ->   ld -m elf_i386 -ggdb -o Shellcode_Execve Shellcode_Execve.o

When i ran it in GDB, i found in below instruction i get error,

Code: [Select]

mov byte [esi + 7], al
Can't we write into that memory?
What is the problem in my code?

Title: Re: Segmentation fault in - mov byte [esi + 7], al
Post by: Frank Kotler on June 30, 2014, 06:38:41 PM

Quote

i am studying shellcode writing.

Bummer.

Quote

Can't we write into that memory?

No. ".text" is readonly.

Sincerely,
Frank

Title: Re: Segmentation fault in - mov byte [esi + 7], al
Post by: melviii100 on July 01, 2014, 02:16:03 PM

Quote from: Frank Kotler on June 30, 2014, 06:38:41 PM

No. ".text" is readonly.

but i have seen many example where they do the same code!
If .text is read only, then how can i overcome that problem to make a shellcode like above?
And Can you please explain how "esi+7" comes in .text sections memory? i don't understand that concept.

Title: Re: Segmentation fault in - mov byte [esi + 7], al
Post by: melviii100 on July 01, 2014, 03:04:46 PM

Quote from: Frank Kotler on June 30, 2014, 06:38:41 PM

No. ".text" is readonly.
Sincerely,
Frank

when i did google i could see it is because "Data Execution Prevention". So how can i disable DEP in ubuntu 14.04

Title: Re: Segmentation fault in - mov byte [esi + 7], al
Post by: Frank Kotler on July 02, 2014, 03:27:05 AM

Firetruckin' script-kiddies! "section kode write exec" might help you. Unless you can tell me a legitimate reason to write code like this, take it to Stack Overflow.

Sincerely,
Frank