segmentation fault at `mov byte [esi+7], al`

Question

Section .text
        global _start

_start:
        jmp short GoToCall

shellcode:
        pop             esi
        xor             eax, eax
        mov byte        [esi+7], al
        lea             ebx, [esi]
        mov long        [esi + 8], ebx
        mov long        [esi + 12], eax
        mov byte        al, 0x0b
        mov             ebx, [esi]
        lea             ecx, [esi + 8]
        lea             edx, [esi + 12]
        int             0x80

GoToCall:
        Call shellcode
        db      "/bin/shJAAAABBBB"

After compiling the above shellcode I got below disassembly. where at 3rd line I am getting the Segmentaion fault.

(gdb) disassemble shellcode 
Dump of assembler code for function shellcode:
   0x08049002 <+0>: pop    %esi
   0x08049003 <+1>: xor    %eax,%eax
=> 0x08049005 <+3>: mov    %al,0x7(%esi)
   0x08049008 <+6>: lea    (%esi),%ebx
   0x0804900a <+8>: mov    %ebx,0x8(%esi)
   0x0804900d <+11>:    mov    %eax,0xc(%esi)
   0x08049010 <+14>:    mov    $0xb,%al
   0x08049012 <+16>:    mov    (%esi),%ebx
   0x08049014 <+18>:    lea    0x8(%esi),%ecx
   0x08049017 <+21>:    lea    0xc(%esi),%edx
   0x0804901a <+24>:    int    $0x80
End of assembler dump.
(gdb) printf "%s", $esi
/bin/shJAAAABBBB(gdb) printf "%s", $esi+7
JAAAABBBB(gdb) si

Program received signal SIGSEGV, Segmentation fault.
0x08049005 in shellcode ()
(gdb) 

Answer 1

The instruction that causes the SIGSEGV is trying to store a '\0' after the 'h' in "/bin/shJAAAABBBB".

All your code/data is in the .text section which is probably read-only. Run objdump -h on the resulting binary, and you should see something like the following in the output:

  5 .text         00000031  00001000  00001000  00001000  2**4
                  CONTENTS, ALLOC, LOAD, READONLY, CODE

which contains the addresses where the bytes of the string are stored.

Answer 2

The memory where you shellcode is located and executed is not writable. It could happen for different reasons, my guess is your shellcode is encoded as a C literal string. Since this memory location is not writable, so you get an exception.

If you just want to try the shellcode, allocate a memory page using mmap(2) with flag PROT_EXEC | PROT_READ | PROT_WRITE, copy your shellcode inside and jump on it.

By the way, your shellcode is null byte free, if you copy it using strcpy(3) function, you can remove both xor eax, eax and mov [esi+7], al because strcpy(3) will write the 0x00 for you. Just make sure to trim "/bin/shJAAAABBBB" to "/bin/sh".

Answer 3

It's because /bin/sh needs \0, so replace it "AAAABBBB" with \0

Answer 4

As the answer of @booto shows, objdump -h prints out .text section is readonly.

You can try to compile like this and don't have to update the original source code:

nasm -f elf32 -o ./Execve.o Execve.nasm
ld -N -o ./Execve ./Execve.o

ld -N:

Set the text and data sections to be readable and writable.