c++ - Re-writing a small execve shellcode -

going through http://hackoftheday.securitytube.net/2013/04/demystifying-execve-shellcode-stack.html

i understood nasm program invokes execve , trying re-write it.

some background information:

int execve(const char *filename, char *const argv[], char *const envp[]); 

so, eax = 11 (function call number execve), ebx should point char* filename, ecx should point argv[] (which same ebx since first argument *filename e.g. "/bin/sh" in case), , edx point envp[] (null in case).

original nasm code:

global _start  section .text _start:  xor eax, eax push eax  ; push //bin/sh in reverse i.e. hs/nib//  push 0x68732f6e push 0x69622f2f  mov ebx, esp  push eax mov edx, esp  push ebx mov ecx, esp  mov al, 11 int 0x80 

the stack follows:

now tried optimize reducing few instructions. agree till mov ebx, esp code remain same. however, since ecx need point ebx, can re-write code follows:

global _start  section .text _start:  xor eax, eax push eax  ; push //bin/sh in reverse i.e. hs/nib//  push 0x68732f6e push 0x69622f2f mov ebx, esp  mov ecx,ebx  push eax mov edx, esp  mov al, 11 int 0x80 

however, segmentation fault when run re-written code.

my stack follows:

any ideas why re-written code not work? i've ran gdb , address values according thinking, won't run.

in both cases ebx pointing string "//bin/sh". equivalent of c code this:

char *ebx = "//bin/sh";   

but in first example, ecx set address of pointer string. equivalent of c code this:

char *temp = "//bin/sh"; // push ebx char **ecx = &temp;      // mov ecx, esp 

while in second example, ecx set same value ebx.

char *ecx = "//bin/sh"; 

the 2 examples fundamentally different, ecx have 2 different types , values.

update:

i should add technically ecx array of char pointers (the argv argument), not pointer char pointer. you're building 2 item array on stack.

char *argv[2]; argv[1] = null;         // push eax, eax being 0 argv[0] = "//bin/sh";   // push ebx ecx = argv;             // mov ecx,esp 

it's half of array doubling envp argument too. since envp single item array single item being set null, can think of envp arguments being set c code this:

edx = envp = &argv[1];            

this achieved setting edx esp while argv array half constructed. combining code 2 assignments this:

char *argv[2]; argv[1] = null;         // push eax, eax being 0 edx = &argv[1];         // mov edx,esp argv[0] = "//bin/sh";   // push ebx ecx = argv;             // mov ecx,esp 

it's bit convoluted, hope makes sense you.

update 2

all of arguments execve passed registers, registers pointers memory needs allocated somewhere - in case, on stack. since stack builds downwards in memory, chunks of memory need constructed in reverse order.

the memory 3 arguments looks this:

char *filename:  2f 2f 62 69 | 6e 2f 73 68 | 00 00 00 00  char *argv[]:    filename    | 00 00 00 00                char *envp[]:    00 00 00 00    

the filename constructed this:

push eax        // '\0' terminator plus push 0x68732f6e // 'h','s','/','n' push 0x69622f2f // 'i','b','/','/' 

the argv argument this:

push eax // null pointer push ebx // filename 

and envp argument this:

push eax // null pointer 

but said, original example decided share memory between argv , evp, there no need last push eax.

i should note reverse order of characters in 2 dwords used when constructing string because of endianess of machine, not stack direction.