在上一节中完成了B程序对A程序的执行控制实例,在此基础上,本节将int80/ int3替换成简单的shellcode,使代码注入过程更加直观。
【环境】
CentOS 6.6 (Final)
Linux version 2.6.32-504.el6.i686
Gcc version 4.4.7 20120313
【A程序:counter.c】
#include <sys/time.h>
#include <stdio.h>
long long timeum(){
struct timeval tim;
gettimeofday (&tim , NULL);
return (long long)tim.tv_sec*1000000+tim.tv_usec;
}
int main()
{
int i;
long long start,tmp;
start = timeum();
for(i = 0; i < 60; ++i){
printf("My Counter: %d\n", i);
sleep(1);
tmp = timeum();
printf("Time Interval: %lld\n",tmp-start);
start = tmp;
}
return 0;
}
gcc -o counter counter.c
【C程序:asmhello.c】
void main()
{
__asm__(
"jmp forward\n\t"
"backward:\n\t"
"popl %esi\n\t"
"movl $4, %eax\n\t"
"movl $2, %ebx\n\t"
"movl %esi, %ecx\n\t"
"movl $12, %edx\n\t"
"int $0x80\n\t"
"int3\n\t"
"forward:\n\t"
"call backward\n\t"
".string \"Hello World\\n\"\n\t"
);
}
gcc -o asmhello asmhello.c
在backward和forward之间的跳转是为了使程序能够找到”hello world” 字符串的地址。 获取二进制代码过程如下:
gdb asmhello
(gdb) disas main
Dump of assembler code for function main:
0x08048394 <+0 >: