0. assembly code to print hello-world
$ cat hello.asmsection .text ; code
global _start ; program entry, used by ld
_start: ; tell linker entry point
; set up for write() system call
mov eax,4 ; set system call # (4 = sys_write)
mov ebx,1 ; file desc (1 = stdout)
mov ecx,msg ; string
mov edx,len ; string length
int 0x80 ; interrupt to kernel
; set up for exit() system call
mov eax,1 ; set system call # (1 = sys_exit)
; ebx has error code
int 0x80 ; call kernel
section .data ; initialized global variables,
; used in code above
msg db 'Hello, world!',0xa ; define string, `db` = 8 bit variable (char)
; 0xa = 10 = newline character in ASCII
len equ $ - msg ; define string len
1. Install nasm
NASM is a assembler/dissembler for Intel x86 architecture$ sudo apt-get install nasm
2. Generate object file from asm in ELF64 format
$ nasm -f elf64 hello.asm// nasm generates hello.o
3. Link object file into an executable
$ ld -s -o hello hello.o// generates hello
4. Run
$ ./helloHello, world!
5. Reverse Engineer
Let's view the binarySections
$ objdump -s hellohello: file format elf64-x86-64
Contents of section .text:
4000b0 ba0e0000 00b9d000 6000bb01 000000b8 ........`.......
4000c0 04000000 cd80b801 000000cd 80 .............
Contents of section .data:
6000d0 48656c6c 6f2c2077 6f726c64 210a Hello, world!.
Disassemble
$ objdump -D hellohello: file format elf64-x86-64
Disassembly of section .text:
00000000004000b0 <.text>:
4000b0: b8 04 00 00 00 mov $0x4,%eax
4000b5: bb 01 00 00 00 mov $0x1,%ebx
4000ba: b9 d0 00 60 00 mov $0x6000d0,%ecx
4000bf: ba 0e 00 00 00 mov $0xe,%edx
4000c4: cd 80 int $0x80
4000c6: b8 01 00 00 00 mov $0x1,%eax
4000cb: cd 80 int $0x80
Disassembly of section .data:
00000000006000d0 <.data>:
6000d0: 48 rex.W
6000d1: 65 6c gs insb (%dx),%es:(%rdi)
6000d3: 6c insb (%dx),%es:(%rdi)
6000d4: 6f outsl %ds:(%rsi),(%dx)
6000d5: 2c 20 sub $0x20,%al
6000d7: 77 6f ja 0x600148
6000d9: 72 6c jb 0x600147
6000db: 64 21 0a and %ecx,%fs:(%rdx)
$
Well, that's it for getting started to write x86 assembly.
I wrote a blog post earlier talking about linux binary analysis, and how you can modify the binary directly instead of recompiling the code.
References:
Syscall reference
https://syscalls.kernelgrok.com/
0 comments:
Post a Comment
Note: only a member of this blog may post a comment.