1

I want execve("/bin/cat",["/bin/cat","/test/file"],NULL).

Here is my asm

xor %rdx, %rdx 
push %rdx

sub $0x16, %rsp
movb $0x2f, 7(%rsp)
movl $0x2f6e6962, 8(%rsp)
movl $0x746163, 12(%rsp)
leaq 7(%rsp), %rdi

pushq %rdx

push %rdi

mov %rsp, %rsi

movb $0x3b, %al 
syscall

This asm, I can get only `execve("/bin/cat",["/bin/cat"],NULL) only.

How can I pass param '/test/file' in rsi?

  • 1
    regarding: execve("/bin/cat",["/bin/cat","/test/file",NULL) the '[' is an invalid character in the second parameter. – user3629249 Jul 9 at 15:06
  • 4
    Suggest: when using gcc to compile, to use the -S option on a C source file. This will result in a file containing the assembly instructions needed to perform the execve() function. Then copy the needed instructions into your file – user3629249 Jul 9 at 15:09
  • @user3629249 I forgot "]", fast type. I edited. I will try your suggestion. Thank – K.Sopheak Jul 9 at 16:21
1

execve specification says:

Both argv and envp must be terminated by a NULL pointer.

but from your question it seems, that you forgot about it; you want to call it like this:

execve("/bin/cat", ["/bin/cat","/test/file", NULL], NULL)

If it still doesn't work, here is the working code in C. You can then follow @user3629249's suggestion and use gcc -S nameOfProgram to get the assembly generated, or just compile it and see the output of objdump -d nameOfProgram.

#include <unistd.h>

int main()
{
    char* argv[3] = {"/bin/cat", "/test/file", NULL};
    execve("/bin/cat", argv, NULL);
}

Not the answer you're looking for? Browse other questions tagged or ask your own question.