Segmentation fault while pushing onto the stack

Question

So I have been following some tutorials on assembly and the instructor compiles the following code:

;hello3.asm  attempts to make the code position independent

section .text
global _start

_start:
;clear out the registers we are going to need
xor eax, eax
xor ebx, ebx
xor ecx, ecx
xor edx, edx

;write(int fd, char *msg, unsigned int len)
mov al, 4
mov bl, 1
;Owned!!! =  4f,77,6e,65,64,21,21,21
;push !,!,!,d
push 0x21212164
;push e,n,w,O 
push 0x656e774f
mov ecx, esp
mov dl, 8
int 0x80

;exit(int ret)
mov al,1
xor ebx, ebx
int 0x80

Note that the message Owned!!! is pushed into the stack rather than kept in the .text segment. So, when I try to execute it, I get a Segment Fault error!

If instead I keep the message in the .text, then, everything works fine.

The commands I used to execute:

$> nasm -f elf64 hello4.asm 
$> ld -o hello hello4.o 

Any ideas?

Answer 1

The segmentation fault error doesn't have anything to do with pushing the strings on the stack.

I used gdb to debug it, and the problem lies at:

;exit(int ret)
mov al,1
xor ebx, ebx
int 0x80

Changing

mov al,1

to

mov eax,1

Fixes the segmentation fault.

Tested on Kali Linux.

Answer 2

In addition to the answer by @user2389688 it's important to note that the syscall numbers are wrong if you're doing amd64, as are the passed in registers. Here's a 64 bit abi version which corrects the differences, and provides the intended output.

;hello3.asm  attempts to make the code position independent
; rewrite of hello3.asm to use 64 bit syscall interface
section .text
global _start

_start:
xor rax, rax ; syscall
xor rdi, rdi ; arg1
xor rsi, rsi ; arg2
xor rdx, rdx ; arg3

; write(int fd, char *msg, unsigned int len)
mov al, 1
mov di, ax
;Owned!!! =  4f,77,6e,65,64,21,21,21
;push !,!,!,d
;push e,n,w,O
sub rsp, 8
mov dword [rsp], 'Owne'
mov dword [rsp + 4], 'd!!!'
mov rsi, rsp
mov dl, 8 
syscall

; exit(int ret)
; syscall errors will result in rax having a negative value so you
; can't just move al
mov eax, 0xffffffc3
not eax
xor rdi, rdi
syscall

Answer 3

I tried your code in a 64 bit machine and there are some considerations:

when you push the 2 snippets of the string, the stack is containing a void word between them:

Breakpoint 1, 0x000000000040009a in _start () [bp before int 0x80] 
(gdb) x/4wx $rsp
0x7fffffffde30: 0x656e774f  0x00000000  0x21212164  0x00000000

This causes the write syscall to fail (as we are indicating the length is 8). So, right after the syscall, in the register %rax contain an error code:

(gdb) ni
0x000000000040009c in _start ()
(gdb) info reg
rax            0xfffffffffffffff2   -14

After that, we move a byte with mov al,1, BUT the resulting value of %rax is: 0xffffffffffffff01.

The exit syscall won't be performed and the code will continue with the contents of the memory... The results are not deterministic... (The segfault occurs somewhere, in my case tries to access to *%rsi when the register %rsi contains a 0.

I hope this helps to anyone.

BTW. Just in case, better if you introduce a null value before the string, in this way you are sure the string will end in a NULL value. Otherwise, if the memory contains another value, write() may print some strange characters.