ВВ
mov rax, rbx($-msg)
Size: a a a
ВВ
mov rax, rbx($-msg)
ВВ
d
d
d
d
E
format ELF executable
entry start
macro Elf32_Sym name,value,size,bind,type,other,shndx
{
dd name+0
dd value+0
dd size+0
db (bind+0) shl 4 + (type+0)
db other+0
dw shndx+0
}
virtual at 0
Elf32_Sym
sizeof.Elf32_Sym = $
end virtual
macro Elf32_Rel offset,symbol,type
{
dd offset+0
dd (symbol+0) shl 8 + (type+0)
}
virtual at 0
Elf32_Rel
sizeof.Elf32_Rel = $
end virtual
DT_NULL = 0
DT_NEEDED = 1
DT_HASH = 4
DT_STRTAB = 5
DT_SYMTAB = 6
DT_RELA = 7
DT_RELASZ = 8
DT_RELAENT = 9
DT_STRSZ = 10
DT_SYMENT = 11
DT_REL = 17
DT_RELSZ = 18
DT_RELENT = 19
STB_LOCAL = 0
STB_GLOBAL = 1
STB_WEAK = 2
STT_NOTYPE = 0
STT_OBJECT = 1
STT_FUNC = 2
STT_SECTION = 3
STT_FILE = 4
R_386_32 = 1
segment interpreter readable
db '/lib/ld-linux.so.2',0
segment dynamic readable
dd DT_NEEDED,_libc-strtab
dd DT_STRTAB,strtab
dd DT_STRSZ,strsz
dd DT_SYMTAB,symtab
dd DT_SYMENT,sizeof.Elf32_Sym
dd DT_REL,rel
dd DT_RELSZ,relsz
dd DT_RELENT,sizeof.Elf32_Rel
dd DT_HASH,hash
dd DT_NULL,0
segment readable writeable
symtab:
Elf32_Sym ; 0 - NULL
Elf32_Sym _system-strtab,0,0,STB_GLOBAL,STT_FUNC,0,0 ; 1 - system
Elf32_Sym _exit-strtab,0,0,STB_GLOBAL,STT_FUNC,0,0 ; 2 - exit
strtab:
_null db 0
_libc db 'libc.so.6',0
_system db 'system',0
_exit db 'exit',0
strsz = $-strtab
rel:
Elf32_Rel system,1,R_386_32
Elf32_Rel exit,2,R_386_32
relsz = $-rel
hash:
dd 1,3 ; size of bucket and size of chain
dd 0 ; fake bucket, just one hash value
times 3 dd % ; chain for all symbol table entries
segment readable executable
start:
push msg
call [system]
call [exit]
segment readable writeable
system dd 0
exit dd 0
msg db 'echo "Test"',0xA,0
https://board.flatassembler.net/topic.php?t=10660E
E
E
d
liblinuxapi.so
d