I wrote the following program in fasm, and am using Evan's Debugger on Ubuntu to debug it:

format ELF64 executable 3

segment readable executable

entry $
mov rbp, rsp
sub rsp, 32
mov rax, 'this a t'
mov [rbp-16], rax
mov rax, 'est'
mov [rbp-8], rax
mov rax, '/bin/ech'
mov [rbp-32], rax
xor rax, rax
mov al, 'o'
mov [rbp-24], rax
push 0
mov rax, 0
mov [rbp], rax

;rdi filename
;rsi argv
;rdx envp
lea rdi, [rbp-32]
xor rdx, rdx
lea r9, [rbp-16]
push r9
lea r9, [rbp-8]
push r9
mov rsi, rsp
mov rax, 0x3b

xor edi,edi     ; exit code 0
mov eax,60      ; sys_exit

Seeing as I wrote it, most of it I understand exactly what it does, but when I open it in the debugger, what I don't understand is why these lines are needed:

lea r9, [rbp-8]
push r9

This pushes the address of "est" onto the stack as the second argument to argv for execve. This address is then supplied in the line mov rsi, rsp as the address of argv array of char pointers to execve. This seems backwards to me because I would think that I need to supply the address of [rbp-32] here since that is the beginning of the argv array, rather than [rbp-8] which is the end of the array. However, this code works as intended.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.