![]() |
|
![]() |
|
|
Thread Tools | Display Modes |
|
|
#1 |
|
Programmer
Join Date: Dec 2005
Posts: 65
Rep Power: 3
![]() |
executing code in the data segment
I'm attempting to execute code in the data segement, but I can't really seem to find much on this topic.
Here's an overview of what I have now: unsigned char block[50] = {0};
/* ...code to fill block with machine instructions here... */
/* try to execute the block with an assembly call */
__asm__ (
"mov %0, %%eax;\
call *%%eax;"
: /* no output */
: "r" (block) /* input variable, replaces %0 in above code */
: "eax" /* tell gcc eax may have changed */
);I'm using GNU GCC as the compiler. When I try to run this, I get a segfault. I think it might be one of two (possibly both) things:
The the first, I tried using mprotect to set the execute permission: int pagesize = getpagesize(); void* target = (block - ((long)block % pagesize))); mprotect(target, 100, (PROT_READ | PROT_WRITE | PROT_EXEC)); For the second, I noticed the address of block is 0xffffd030, which seems unlikely to me. I'm not too familiar with assembly, and I think I may need to use a lea instruction rather than a plain mov, but I'm not certain. Also, is there a way to do this in C, avoiding inline assembly? The assembly doesn't bother me much (if I knew a little more about what I was doing with it), but it would be nice to use C since it's more portable. Thanks ![]() int main() {
typedef int (*fadd)(int, int);
/* code for function: int add(int a, int b) { return a+b; } */
byte block[] = {
0x55, //push %ebp
0x89, 0xe5, //mov %esp,%ebp
0x8b, 0x45, 0x0c, //mov 0xc(%ebp),%eax
0x03, 0x45, 0x08, //add 0x8(%ebp),%eax
0xc9, //leave
0xc3, //ret
0x90, //nop
0x8d, 0x74, 0x26, 0x00 //lea 0x0(%esi),%esi
};
int pagesize;
int i;
pagesize = getpagesize();
if (mprotect((block - ((long)block % pagesize)), 16, PROT_EXEC) == -1) {
perror("mprotect()");
return 0;
}
fadd fptr = block;
i = (*fptr)(1, 2);
printf("fptr = %i\n", i);
return 0;Last edited by para; Jan 3rd, 2006 at 6:04 PM. |
|
|
|
|
|
#2 |
|
Hobbyist Programmer
Join Date: Jun 2005
Location: New Mexico
Posts: 228
Rep Power: 4
![]() |
google for shellcode. You are having protection problems
or find a copy of Jack Koziol's 'Shellcoder's Handbook' A lot of exploits begin by executing code injected into various parts of memory. |
|
|
|
![]() |
| Bookmarks |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| Display Modes | |
|
|