shellcode - simplifed code does not work

Question

I dont know why but when I use the hex of below code as shell code it works:

Section .text global _start _start: mov ebx,0 mov eax,1 int 0x80

but when I use the hex of the below code instead, it does not work and segmentation fault occurres:

Section .text global _start _start: xor ebx,ebx mov al,1 int 0x80

I know that is because of using 'al'. I don`t know why does using of 'eax' works correctly but using 'al' get error?

Thanks a lot.

Ya Ali.

Alexander Zhak · Accepted Answer · 2015-03-17 08:41:30Z

1

Because int 0x80 expects 32-bit param. When you pass low 8 bits only (AL), high parts of eax may contain anything (undefined value), so instead of passing 1 you end up passing 0x??????01

answered Mar 17, 2015 at 8:41

Alexander Zhak

9,2824 gold badges49 silver badges75 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Mohammad Reza Ramezani Over a year ago

Thanks. I reading 2 books that use 'al' without any error. How can use 'al' correctly?

Alexander Zhak Over a year ago

xor eax, eax\mov al, 1, but why? What's wrong with eax?

Mohammad Reza Ramezani Over a year ago

In shellcode '\x00' must not be appeared. When we use 'eax' \x00 is appeared. with using of 'al', there is no \x00 anymore

Wug Over a year ago

Try zeroing $eax first using the same xor trick you use on $ebx. It's a month later than your question was asked, wheee!

Collectives™ on Stack Overflow

shellcode - simplifed code does not work

1 Answer 1

4 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Related