2

I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working.

Per the sys_mprotect definition, it takes the parameters as shown below:

rdi -> start_address
rsi -> length
rdx -> protection

Note: I have corrected the parameters above. The issue is not related to the parameter sequence.

so, I'm issuing the syscall as shown below:

push 0xA
pop rax
push 0x7
pop rdx
mov rdi, start_address
mov rsi, 0x1000
syscall

At the time of syscall, I verified that the registers are set properly.

start_address points to the main() subroutine inside the .text section which I want to modify.

However, the syscall does not modify the protection to RWX after execution. I verified the protection by viewing segments in IDA Pro.

Per the syscall_mprotect definition, the other registers don't have to be configured specifically for this syscall. So, I am not sure why this syscall is not working?

Update: I modified the start_address so that it's page aligned.

start_address = start_address - (start_address % 4096)

Now, syscall_mprotect does not return a negative value. It returns 0. However, the .text segment still doesn't show the writable flag.

2 Answers 2

1

Your parameters for mprotect are not correct. Here's the correct order

start: rdi
len:   rsi
prot:  rdx

The shellcode that works is

push 0xA
pop rax
push 0x7
pop rdx
call x
x:pop rdi
and rdi, 0xfffffffffffff000
mov rsi, 0x1000
syscall

The call x x: pop rdi is used to get the current rip. Assuming the code is in .text this should work. Link for reference on syscalls x86 x64

3
  • I made an error while writing the post. So, that's not the issue here. I was using the correct parameters while executing the code. And in my case, the shellcode is not executing in the .text section. It is executing in another mapped region of the process. I'll check again. As I mentioned in the update of my post, if I align start address to page boundary, then mprotect returns 0x0 (success) instead of an error. However, the "W" flag for the .text segment is still not shown enabled in the program segments section of IDA Pro.
    – Neon Flash
    Dec 2, 2018 at 4:11
  • 1
    can you check /proc/pid/maps ?
    – sudhackar
    Dec 2, 2018 at 5:30
  • Yes, I'll check that. The syscall does work properly, it seems that IDA Pro does not update the protection flags for program segments in real time.
    – Neon Flash
    Dec 5, 2018 at 22:07
1

IDA does not update memory map after each step since it can potentially take a long time. You can try to either use “run to”(F4) instead of stepping or force refresh by calling refresh_debugger_memory() IDC function.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.