10
votes
Accepted
Need advice : Reverse engineering a pdf with shellcode
The shellcode is unicode escaped. You can convert it to its hex representation using a simple python script.
from binascii import unhexlify as unhx
encoded = open('encoded.txt').read() # The ...
- 5,990
9
votes
Accepted
Heap Chunk Structure Does Not Contain Previous Section Info
The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free.
This image is more appropriate of what an allocated heap ...
- 5,990
9
votes
Accepted
Shellcode challenge - shellcode works in test program, segfaults in actual binary
It looks like you have two issues.
1) You are overwriting your input buffer with those push-es so that why you have some junk on the stack and that's why our application crashes.
See those two ...
- 4,692
9
votes
Accepted
How does this version of `rm -rf /` work?
It's not run in the example. It's a shellcode, it has to be somehow injected (for example using a buffer overflow vulnerability).
To understand how it works, let's first put some addresses on the ...
- 410
6
votes
Accepted
ASM working as is, but not in a C program
The problem with you shellcode and the why it differs if you run from C program or not is the initial values.
The registers that are used when executing execv (second page) are:
eax = 0x0b
ebx = ptr ...
- 4,692
6
votes
Accepted
IDA Pro: Program parameters
Try using IDC function StartDebugger. You can pass a C-style string (e.g. "\x55\x89\xe5")for program arguments:
***********************************************
** Launch the debugger
arguments:
...
- 35.8k
5
votes
Accepted
Strcpy BufferOverflow get shellcode location for EIP
68 A bytes - 23 shellcode bytes: 45 NOPs.
NOP is the mnemonic that stands for No OPeration which is the byte \x90, meaning that you'll have to change the A's (\x41) for NOPs (\x90), because \x41 by ...
- 176
5
votes
Accepted
alphanumeric shellcode
Alphanumeric shellcode expects the location of the shellcode to be stored in a register, since the usual technique of call/pop can't be performed with the limited character set.
In your example above ...
- 258
5
votes
Accepted
x86-64 CALL opcode + disassembly
relative address can be forward or backward from end of current instruction
or start of next instruction
that e8 00 00 00 00 will be call to the next immediate instruction
forward can be e8 ( ...
- 15.8k
5
votes
Accepted
Shellcode not working correctly
You're showing x86 (32bit) shellcode, but are not compiling your program for that architecture, so gcc most likely creates an amd64 (64bit) executable instead. This can be fixed by adding the -m32 ...
- 166
4
votes
Accepted
ARM shellcode using r0 without null characters
Copy/pasted from the online disassembler:
.data :00000000 e0522002 subs r2, r2, r2
.data :00000004 e92d0104 push {r2, r8}
.data :00000008 e8bd0101 pop {r0, r8}
Or, in thumb mode (the push/...
- 12.8k
4
votes
How to load shellcode into Ghidra
Compile and load:
#include <stdio.h>
char shellcode[] =
"\x48\x83\xEC\x28\x48\x83\xE4\xF0\x48\x8D\x15\x66\x00\x00\x00"
"\x48\x8D\x0D\x52\x00\x00\x00\xE8\x9E\x00\...
- 175
4
votes
Accepted
How to load shellcode into Ghidra
you have a string you cant load a string as is into a disassembler
you may need to un-escape them into binary
for example
"\x48" is "H"
if you have a compiler compile and call it ...
- 15.8k
3
votes
Meaning of code used to find kernel32.dll in shellcode
In WinDbg:
0:000> dt ntdll!_TEB -y ProcessEnvironmentBlock->Ldr->InM
+0x030 ProcessEnvironmentBlock :
+0x00c Ldr :
+0x014 ...
- 15.8k
3
votes
Accepted
how to find memory objects using immunity debugger
Put a INT3 (F2) breakpoint on the recv function (To jump to that function, hit CTRL+G then type recv to the textbox which just appeared, and then hit enter) within Immunity Debugger, and observe the ...
- 2,028
3
votes
Accepted
Basic shellcode doesn't work when read from stdin
With the shellcode given I was not able to get a shell. If you strace the binary when getting input from the stack
execve("/bin//sh", ["/bin//sh"], [/* 0 vars */]) = -1 EFAULT (Bad address)
char *...
- 2,454
3
votes
Accepted
How to dynamically load address of USER32.DLL in shellcode?
If user32.dll is already loaded in the process's address space (and I assume it is given that you said it's a Windows GUI application), you can walk the PEB_LDR_DATA structure in order to find the ...
- 20.6k
3
votes
ASM working as is, but not in a C program
Okay, so according to gdb the shellcode does run, so it's probably placed into .text. You should try to step through the shellcode (e.g. using stepi) to see on what instruction it faults.
- 35.8k
3
votes
A buffer overflow exercise using a shellcode
Okay, so I will try to answer to all your questions and add a few remarks.
Do not disable ASLR system-wide, prefer to disable it within the current process.
In fact, echoing 0 in randomize_va_space ...
- 18.7k
3
votes
Accepted
Buffer overflow on server
We have two major stack protection for buffer overflows:
Stack canaries
Non-executable stack
You land on nopsled but, you get segmentation fault. Because your operating system marked program stack ...
3
votes
Accepted
Working Linux assembly XOR Encoder/Decoder Failing on Windows
There are few issues with your code.
1st is what Igor mentioned - .text section is RO. This was solved in this answer.
The 2nd is that you did not copy correctly the bytes or lost some of them in ...
- 4,692
3
votes
Accepted
x86 shellcode leads to segmentation fault
Wrong Parameters
I was able to solve my problem!
The function execve has the following definition:
int execve(const char *filename, char *const argv[], char *const envp[]);`
^ ...
- 161
3
votes
Accepted
WinDBG Hung on Shellcode Execution
can you clarify if the error you are getting is related to message that says this may be caused by another thread holding the LoaderLock ?
if that is the case then it means you allocate memory etc ...
- 15.8k
3
votes
ShellCode not running as expected - showing segmentation fault core dump
The argument -z execstack only allows stack to execute code, but the code is a global variable, which is not on stack, so you can do some simple changes to make your code work.
For example,
#include &...
- 31
3
votes
x64 buffer overflow - tcp shell payload
process 6540 is executing new program: /bin/dash
Error in re-setting breakpoint 1: No symbol table is loaded. Use the "file" command.
That's not an error you need to worry about, it likely ...
- 599
2
votes
Working Linux assembly XOR Encoder/Decoder Failing on Windows
I think the problem is that the executable code is not writeable by default on Windows, so it fails when xor tries to modify the code. You should look into how to modify .text section permissions, ...
- 35.8k
2
votes
Accepted
Debugging EXE File in Windbg and How to set Breakpoints in Assembly
It seems bp $exentry should set breakpoint on the entrypoint, then you can continue (g) until you hit it.
- 35.8k
2
votes
Accepted
Reverse a BFLT file
bFLT format is used in uCLinux systems and its executables use one of two approaches to make system calls:
Statically linked libc (uClibc). In this case you should see explicit syscalls (SVC ...
- 35.8k
2
votes
Accepted
How to Make .text Section in Assembly Writeable for Win7-64 EXE
I don't see that option in golink linker but if you use i.e. link.exe (Microsoft (R) Incremental Linker Version 14.11.25506.0) then you can use /SECTION parameter to specify that.
link /SUBSYSTEM:...
- 4,692
Only top scored, non community-wiki answers of a minimum length are eligible