exit() syscall within shellcode not working

Question

int main()
{
    char shellcode[] = "\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80";

    int *ret;
    ret = (int *)&ret + 2;
    (*ret) = (int)shellcode;
}

I tried to run the above shellcode but got a segmentation fault. Then, I tried putting the shellcode inside the main and it worked, why?

Also, when I do strace to the binary to check the syscall, it shows that exit_group() syscall is called but the shell code is for exit() syscall.

Answer 1

First of all, the opcodes that you are pointing are not responsible for the syscall. If you disassemble your shellcode, you get:

0000000000004028 <shellcode>:
    4028:   bb 00 00 00 00          mov    $0x0,%ebx
    402d:   b8 01 00 00 00          mov    $0x1,%eax
    4032:   cd 80                   int    $0x80

A first mov to set ebx to zero (the return code), then a second mov to set eax to the id of the exit syscall, and finally it trigger the system call.

Second, this shellcode is obviously designed for a 32-bit architecture. And, you have to know that the syscall numbers are different between i386 and amd64.

So, my recommendation would be that you compile your program with the option -m32 to ensure that you have a full 32-bit program (and not a mix between 64-bit and 32-bit).

Third, you need to be sure that you compile with -zexecstack in order to be able to execute the code in case it is stored on the stack.

Finally, there is no evidence that getting ret + 2 will set your pointer in front of the saved eip. You'd better write:

int main()
{
    char shellcode[] = "\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80";

    (*(void(*)()) shellcode)();
    return 0;
}

Answer 2

div eax
int 0x80
jmp short 0x0

It's different ways exit() syscall