I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working.
Per the sys_mprotect definition, it takes the parameters as shown below:
rdi -> start_address
rsi -> length
rdx -> protection
Note: I have corrected the parameters above. The issue is not related to the parameter sequence.
so, I'm issuing the syscall as shown below:
push 0xA
pop rax
push 0x7
pop rdx
mov rdi, start_address
mov rsi, 0x1000
syscall
At the time of syscall, I verified that the registers are set properly.
start_address points to the main() subroutine inside the .text section which I want to modify.
However, the syscall does not modify the protection to RWX after execution. I verified the protection by viewing segments in IDA Pro.
Per the syscall_mprotect definition, the other registers don't have to be configured specifically for this syscall. So, I am not sure why this syscall is not working?
Update: I modified the start_address so that it's page aligned.
start_address = start_address - (start_address % 4096)
Now, syscall_mprotect does not return a negative value. It returns 0. However, the .text segment still doesn't show the writable flag.