0

I'd like to know why NASM generates different opcodes for the same code, when it's in the begin or end of the program? This question is important because I found NULL characters when I compile the jumper label in the begin of the program, but when I write the same code in the end, it changes and there's no NULL character there. Could anyone give me a hint about it? I have here the NASM code, and the output of objdump.

NASM code (jumper label in the begin of code):

global _start

section .text

jumper:
        call shellcode
        msg: db "Hello World",0xA

_start:
        jmp short jumper

shellcode:
        xor edx, edx
        mov dl, 0xc

        pop ecx

        xor ebx, ebx
        inc bl
        xor eax, eax
        times 0x04 inc al
        int 0x80 

        xor ebx, ebx
        xor eax, eax
        inc eax
        int 0x80

It has NULL characters as we can see... (objdump results) Generate with above code:

hello-shellcode:     file format elf32-i386


Disassembly of section .text:

08049000 <jumper>:
 8049000:       e8 0e 00 00 00          call   8049013 <shellcode>

08049005 <msg>:
 8049005:       48                      dec    eax
 8049006:       65 6c                   gs ins BYTE PTR es:[edi],dx
 8049008:       6c                      ins    BYTE PTR es:[edi],dx
 8049009:       6f                      outs   dx,DWORD PTR ds:[esi]
 804900a:       20 57 6f                and    BYTE PTR [edi+0x6f],dl
 804900d:       72 6c                   jb     804907b <shellcode+0x68>
 804900f:       64                      fs
 8049010:       0a                      .byte 0xa

08049011 <_start>:
 8049011:       eb ed                   jmp    8049000 <jumper>

08049013 <shellcode>:
 8049013:       31 d2                   xor    edx,edx
 8049015:       b2 0c                   mov    dl,0xc
 8049017:       59                      pop    ecx
 8049018:       31 db                   xor    ebx,ebx
 804901a:       fe c3                   inc    bl
 804901c:       31 c0                   xor    eax,eax
 804901e:       fe c0                   inc    al
 8049020:       fe c0                   inc    al
 8049022:       fe c0                   inc    al
 8049024:       fe c0                   inc    al
 8049026:       cd 80                   int    0x80
 8049028:       31 db                   xor    ebx,ebx
 804902a:       31 c0                   xor    eax,eax
 804902c:       40                      inc    eax
 804902d:       cd 80                   int    0x80

Now I'll change the jumper label to the end:

global _start

section .text

_start:
        jmp short jumper

shellcode:
        xor edx, edx
        mov dl, 0xc

        pop ecx

        xor ebx, ebx
        inc bl
        xor eax, eax
        times 0x04 inc al
        int 0x80 

        xor ebx, ebx
        xor eax, eax
        inc eax
        int 0x80

jumper:
        call shellcode
        msg: db "Hello World",0xA

(objdump generate with above code) It hasn`t NULL character:

objdump -d hello-shellcode -M intel

hello-shellcode:     file format elf32-i386


Disassembly of section .text:

08049000 <_start>:
 8049000:       eb 1c                   jmp    804901e <jumper>

08049002 <shellcode>:
 8049002:       31 d2                   xor    edx,edx
 8049004:       b2 0c                   mov    dl,0xc
 8049006:       59                      pop    ecx
 8049007:       31 db                   xor    ebx,ebx
 8049009:       fe c3                   inc    bl
 804900b:       31 c0                   xor    eax,eax
 804900d:       fe c0                   inc    al
 804900f:       fe c0                   inc    al
 8049011:       fe c0                   inc    al
 8049013:       fe c0                   inc    al
 8049015:       cd 80                   int    0x80
 8049017:       31 db                   xor    ebx,ebx
 8049019:       31 c0                   xor    eax,eax
 804901b:       40                      inc    eax
 804901c:       cd 80                   int    0x80

0804901e <jumper>:
 804901e:       e8 df ff ff ff          call   8049002 <shellcode>

08049023 <msg>:
 8049023:       48                      dec    eax
 8049024:       65 6c                   gs ins BYTE PTR es:[edi],dx
 8049026:       6c                      ins    BYTE PTR es:[edi],dx
 8049027:       6f                      outs   dx,DWORD PTR ds:[esi]
 8049028:       20 57 6f                and    BYTE PTR [edi+0x6f],dl
 804902b:       72 6c                   jb     8049099 <msg+0x76>
 804902d:       64                      fs
 804902e:       0a                      .byte 0xa

First shellcode: "\xe8\x0e\x00\x00\x00\x48\x65\x6c\x6c\x6f\x20\x57\x6f\x72\x6c\x64\x0a\xeb\xed\x31\xd2\xb2\x0c\x59\x31\xdb\xfe\xc3\x31\xc0\xfe\xc0\xfe\xc0\xfe\xc0\xfe\xc0\xcd\x80\x31\xdb\x31\xc0\x40\xcd\x80"

Second shellcode: "\xeb\x1c\x31\xd2\xb2\x0c\x59\x31\xdb\xfe\xc3\x31\xc0\xfe\xc0\xfe\xc0\xfe\xc0\xfe\xc0\xcd\x80\x31\xdb\x31\xc0\x40\xcd\x80\xe8\xdf\xff\xff\xff\x48\x65\x6c\x6c\x6f\x20\x57\x6f\x72\x6c\x64\x0a"

0

CALLs and JMP (Jxx) are relative.

In your first code block the "jumper" code jumps forward 0e bytes, which is "0e 00 00 00" in little endian.

In your second code, "jumper" appears after "shellcode", so the CALL backwards is a negative int, and results in your case in "df ff ff ff".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.