I wrote some code that does the following:
Searches for and finds an offset in a binary file to add code (looks for a sequence of 00s I can overwrite).
Then, I change the entrypoint of the ELF to the above address.
Then, I write my code to the address and
jmpback to the original entrypoint.
So, what happens is when the binary starts it will execute code at the address I changed the entrypoint to, I can see my code in
gdb but any kind of instruction other than
nop will trigger a segfault.
Can ayone help me understand why this happen?
For the record, in the binary I am using, the place where I write my code is a place where I found a bunch of
00s. It is in the
I added the executable flag to the section in case that was the cause, but it did not help.
I am trying to add code to a "hello world" program written in C. An offset in the following section is located as a place to write code to:
Before any modifications the binary has the following:
Section:  .eh_frame Addr: 00000000004005d0 Offset: 0005d0 Size: 0000f4 Flags: A Entry point address: 0x400400
After my code runs:
Section:  .eh_frame Addr: 00000000004005d0 Offset: 0005d0 Size: 0000f4 Flags: A**WX** Entry point address: **0x4006b6**
Breakpoint 1, 0x00000000004006b6 in ?? () (gdb) x/10i $rip => 0x4006b6: nop 0x4006b7: nop 0x4006b8: nop 0x4006b9: add 0x1,%ebx
When I hit the
add 0x1, %ebx the program segfaults.
** I've also tried a
add 0x1, %rbx.
I am pretty sure I found the issue.
When writing my assembly code I was using GCC and then using the eXamine command to get the bytes for each instruction but I was doing something like this:
__asm__("movl 0x00, %rax") (trying to access 0x00 location..)
__asm__("movl $0x00, %rax") (moving a
0 constant into register as I wanted).
So, I am an idiot but at least I realized it myself ;))
thanks all who looked and helped.