I wrote some code that does the following:
Searches for and finds an offset in a binary file to add code (looks for a sequence of 00s I can overwrite).
Then, I change the entrypoint of the ELF to the above address.
Then, I write my code to the address and
jmp
back to the original entrypoint.
So, what happens is when the binary starts it will execute code at the address I changed the entrypoint to, I can see my code in gdb
but any kind of instruction other than nop
will trigger a segfault.
Can ayone help me understand why this happen?
For the record, in the binary I am using, the place where I write my code is a place where I found a bunch of 00
s. It is in the .eh_frame
section.
I added the executable flag to the section in case that was the cause, but it did not help.
I am trying to add code to a "hello world" program written in C. An offset in the following section is located as a place to write code to:
Before any modifications the binary has the following:
Section: [17] .eh_frame
Addr: 00000000004005d0 Offset: 0005d0 Size: 0000f4 Flags: A
Entry point address: 0x400400
After my code runs:
Section: [17] .eh_frame
Addr: 00000000004005d0 Offset: 0005d0 Size: 0000f4 Flags: A**WX**
Entry point address: **0x4006b6**
Inside GDB:
Breakpoint 1, 0x00000000004006b6 in ?? ()
(gdb) x/10i $rip
=> 0x4006b6: nop
0x4006b7: nop
0x4006b8: nop
0x4006b9: add 0x1,%ebx
When I hit the add 0x1, %ebx
the program segfaults.
** I've also tried a add 0x1, %rbx
.
EDIT
I am pretty sure I found the issue.
When writing my assembly code I was using GCC and then using the eXamine command to get the bytes for each instruction but I was doing something like this:
__asm__("movl 0x00, %rax") (trying to access 0x00 location..)
Instead of __asm__("movl $0x00, %rax")
(moving a 0
constant into register as I wanted).
So, I am an idiot but at least I realized it myself ;))
thanks all who looked and helped.