Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I want execve("/bin/cat",["/bin/cat","/test/file"],NULL).
Here is my asm
xor %rdx, %rdx
push %rdx
sub $0x16, %rsp
movb $0x2f, 7(%rsp)
movl $0x2f6e6962, 8(%rsp)
movl $0x746163, 12(%rsp)
leaq 7(%rsp), %rdi
pushq %rdx
push %rdi
mov %rsp, %rsi
movb $0x3b, %al
syscall
This asm, I can get only `execve("/bin/cat",["/bin/cat"],NULL) only.
How can I pass param '/test/file' in rsi?
execve specification says:
Both argv and envp must be terminated by a NULL pointer.
but from your question it seems, that you forgot about it; you want to call it like this:
execve("/bin/cat", ["/bin/cat","/test/file", NULL], NULL)
If it still doesn't work, here is the working code in C. You can then follow @user3629249's suggestion and use gcc -S nameOfProgram to get the assembly generated, or just compile it and see the output of objdump -d nameOfProgram.
#include <unistd.h>
int main()
{
char* argv[3] = {"/bin/cat", "/test/file", NULL};
execve("/bin/cat", argv, NULL);
}
execve("/bin/cat",["/bin/cat","/test/file",NULL)the '[' is an invalid character in the second parameter. – user3629249 Jul 9 '19 at 15:06gccto compile, to use the-Soption on a C source file. This will result in a file containing the assembly instructions needed to perform theexecve()function. Then copy the needed instructions into your file – user3629249 Jul 9 '19 at 15:09