Repository navigation
Expand file tree
/
Copy pathshellcode3.html
More file actions
113 lines (90 loc) · 5.83 KB
/
Copy pathshellcode3.html
File metadata and controls
113 lines (90 loc) · 5.83 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<meta name="resource-type" content="document" />
<meta name="keywords" content="kernel,panic,OpenBSD,Linux,shellcode,x86,IA32,intel,security,docs" />
<meta name="distribution" content="global" />
<meta name="author" content="Daniele Mazzocchio" />
<meta name="copyright" content="This document copyright 2005-2006 by Kernel-Panic.it." />
<title>Writing shellcode for Linux and *BSD - *BSD system calls</title>
<link rel="stylesheet" type="text/css" href="../../css/docs.css" />
<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon" />
</head>
<body>
<div class="navigation">
<ul>
<li class="prev"><a class="nav-list" href="shellcode2.html"><span>Previous</span></a></li>
<li class="up"><a class="nav-list" href="index.html"><span>Up</span></a></li>
<li class="next"><a class="nav-list" href="shellcode4.html"><span>Next</span></a></li>
<li class="home"><a class="nav-list" href="../../index.html"><span>Home</span></a></li>
</ul>
<h3>Writing shellcode for Linux and *BSD</h3>
<div>Previous: <a href="shellcode2.html">2. Linux system calls</a>
Up: <a href="index.html">Table of contents</a>
Next: <a href="shellcode4.html">4. Writing the shellcode</a>
</div>
</div>
<hr />
<h2>3. *BSD system calls</h2>
<p>In the *BSD family, direct system calls (i.e. through the 0x80 interrupt) are slightly different than in Linux, while there's no difference in indirect system calls (i.e. using the libc functions addresses).</p>
<p>The numbers of the syscalls are listed in the <tt>/usr/src/sys/kern/syscalls.master</tt> file, which also contains the prototypes of the syscall functions. Here are the first lines of the file on OpenBSD:</p>
<div class="code">
<div>/usr/src/sys/kern/syscalls.master</div>
<pre>
[...]
1 STD { void sys_exit(int rval); }
2 STD { int sys_fork(void); }
3 STD { ssize_t sys_read(int fd, void *buf, size_t nbyte); }
4 STD { ssize_t sys_write(int fd, const void *buf, \
size_t nbyte); }
5 STD { int sys_open(const char *path, \
int flags, ... mode_t mode); }
6 STD { int sys_close(int fd); }
7 STD { pid_t sys_wait4(pid_t pid, int *status, int options, \
struct rusage *rusage); }
8 COMPAT_43 { int sys_creat(const char *path, mode_t mode); } ocreat
[...]
</pre>
</div>
<p>The first column contains the system call number, the second contains the type of the system call and the third the prototype of the function.</p>
<p>Unlike Linux, *BSD system calls don't use the <dfn>fastcall convention</dfn> (i.e. passing arguments in registers), but use the <dfn>C calling convention</dfn> instead, pushing arguments on the stack. Arguments are pushed in reverse order (from right to left), so that they are extracted in the correct order by the function. Immediately after the system call returns, the stack needs to be cleaned up by adding to the <dfn>stack pointer</dfn> (<tt>ESP</tt>) a number equal to the size, in bytes, of the arguments (to put it simply, you have to add the number of arguments multiplied by 4).</p>
<p>The role of the <tt>EAX</tt> register, instead, remains the same: it must contain the syscall number and will eventually contain the return value. Therefore, to recap, executing a system call requires four steps:</p>
<ol>
<li>storing the syscall number in <tt>EAX</tt>;</li>
<li>pushing (in reverse order) the arguments on the stack;</li>
<li>executing the 0x80 software interrupt;</li>
<li>cleaning up the stack.</li>
</ol>
<p>The <a href="shellcode2.html#exit.asm">previous example</a> for Linux, now becomes on *BSD:</p>
<div class="code">
<div>exit_BSD.asm</div>
<pre>
mov eax, 1 ; Syscall number
push dword 0 ; rval
push eax ; Push one more dword (see below)
int 0x80 ; 0x80 interrupt
add esp, 8 ; Clean up the stack
</pre>
</div>
<p>As you can see, before executing the software interrupt, you need to push one extra <tt>dword</tt> on the stack (any <tt>dword</tt> will do); for an in-depth discussion on this topic, please refer to [<a href="http://www.int80h.org/bsdasm/#default-calling-convention">FreeBSD</a>].</p>
<hr />
<div class="navigation">
<ul>
<li class="prev"><a class="nav-list" href="shellcode2.html"><span>Previous</span></a></li>
<li class="up"><a class="nav-list" href="index.html"><span>Up</span></a></li>
<li class="next"><a class="nav-list" href="shellcode4.html"><span>Next</span></a></li>
<li class="home"><a class="nav-list" href="../../index.html"><span>Home</span></a></li>
</ul>
<h3>Writing shellcode for Linux and *BSD</h3>
<div>Previous: <a href="shellcode2.html">2. Linux system calls</a>
Up: <a href="index.html">Table of contents</a>
Next: <a href="shellcode4.html">4. Writing the shellcode</a>
</div>
</div>
<script type="text/javascript">var sc_project=873554, sc_invisible=1, sc_partition=7, sc_security="03daa6ce";</script>
<script type="text/javascript" src="http://www.statcounter.com/counter/counter_xhtml.js"></script>
<noscript><div class="statcounter"><a class="statcounter" href="http://www.statcounter.com/"><img class="statcounter" src="http://c8.statcounter.com/counter.php?sc_project=873554&java=0&security=03daa6ce&invisible=1" alt="counter" /></a></div></noscript>
</body>
</html>