Jump to content


Photo
- - - - -

asm


  • Please log in to reply
6 replies to this topic

#1 screamer

screamer

    SUPR3M3 31337 Mack Daddy P1MP

  • Members
  • 347 posts

Posted 08 March 2003 - 08:28 PM

Finally decided to move into the realm of assembler and shellcoding, anyone know of any good tutorials?

Oh, and one question: I've been reading a lot about writing shellcode by using assembler, and then throwing the program into gdb to examine the endian it spits out...but I'm somewhat confused. It says the following.

push $0x6d6f7266 #push from on the stack
push $0x20626f62 #push bob on the stack

(where "from" and "bob" are simply words being sent to write() to be printed to the screen)

But the article never explains how you know to translate the words "bob" and "from" into the hex shown above...can anyone fill me in? Or at least point me to the right spot online.

#2 dual

dual

    BinRev veteran

  • Agents of the Revolution
  • 1,196 posts
  • Gender:Male

Posted 09 March 2003 - 12:29 PM

Get in touch with Zapperlink.

#3 screamer

screamer

    SUPR3M3 31337 Mack Daddy P1MP

  • Members
  • 347 posts

Posted 09 March 2003 - 05:07 PM

Arright, will do. Thanks.

#4 ntheory

ntheory

    data pillager

  • Agents of the Revolution
  • 1,757 posts

Posted 15 April 2003 - 07:01 PM

Hmmm... no followups on this. For anyone who was looking for an explanation here goes...

The original code is:
push $0x6d6f7266 #push from on the stack
push $0x20626f62 #push bob on the stack

They probably should've put "from" and "bob" in quotes. What goes on the stack is actually the string "from" and then the string "bob " (notice the space at the end). The numbers are the hexadecimal representations of the strings.

0x6d == "m"
0x6f == "o"
0x72 == "r"
0x66 == "f"

0x20 == space
0x62 == "b"
0x6f == "o"
0x62 == "b"

Of course you'll notice the strings are in reverse order. This is because Intel arranges its memory in a format called "little-endian". Basically this means that the "little end" goes first and is really annoying when you're reading hex dumps.

If anyone wants more of an explanation just let me know.

#5 White_Raven

White_Raven

    That's so raven!

  • Banned
  • 1,597 posts

Posted 15 April 2003 - 08:12 PM

thats why gnu has such nice tools for reading dumps.. people just hate doing it by hand.. ;)

nice info nick.

#6 dual

dual

    BinRev veteran

  • Agents of the Revolution
  • 1,196 posts
  • Gender:Male

Posted 16 April 2003 - 02:07 AM

Thanks for the info, ntheory. That stuff fascinates me.

#7 ntheory

ntheory

    data pillager

  • Agents of the Revolution
  • 1,757 posts

Posted 16 April 2003 - 06:45 AM

No worries. Feel free to bounce more Intel (or Sparc) asm questions off of me anytime guys.




BinRev is hosted by the great people at Lunarpages!