使用气体，如何获得特定标签的偏移量？

Question

I'm using pwnlib to write a small shellcode for a challenge. My shellcode needs to modify itself to pass application filters. I first wrote it with nasm, and did something like that:

        sub        edx, edx
        mov        dl, 0x82
        add        al, do_mov_rdi_rax
        sub        dword [rax], edx
        mov        dh, 0x82
        add        al, do_syscall - do_mov_rdi_rax
        sub        dword [rax], edx
        shr        edi, 31

    do_mov_rdi_rax:
        ; mov    rsi, rax
        ; (with 0x82 added to first byte to pass validation)
        db         0xca, 0x89, 0xc6
        sub        eax, eax

    do_syscall:
        ; syscall
        ; (with 0x82 added to both bytes to pass validation)
        db         0x91, 0x87

Pwnlib uses gas , however, so my assembly code has to conform to its syntax. Besides the obvious ( // instead of ; , .byte instead of db ), I'm stuck with one last problem: while nasm happily converted my labels to integers (for add al, do_mov_rdi_rax and add al, do_syscall - do_mov_rdi_rax ), gas keeps telling me that it can't represent addressing type BFD_RELOC_8 , or something like that (I somehow ended up with a French version of gas , sorry for the lacking error message).

How can I get the address of the labels as integers? My shellcode is based at address 0 (and gas is told with .org 0x0 ).

Answer 1

Since labels wouldn't work, I dug through the gas documentation and found that it's also possible to create expression symbols, and that one could use . to get the location's address. As it turns out, with the Mach-O output format, gas will accept this:

.set main, .
    sub     edx, edx
    mov     dl, 0x82
    add     al, do_mov_rdi_rax - main
    sub     dword [rax], edx
    mov     dh, 0x82
    add     al, do_syscall - do_mov_rdi_rax
    sub     dword [rax], edx
    shr     edi, 31

.set do_mov_rdi_rax, .
    // mov  rsi, rax
    // (with 0x82 added to first byte to pass validation)
    .byte   0xca, 0x89, 0xc6
    sub     eax, eax

.set do_syscall, .
    // syscall
    // (with 0x82 added to both bytes to pass validation)
    .byte   0x91, 0x87

On the first add, simply using do_mov_rdi_rax wouldn't work, but using the difference between it and main worked perfectly. (Replacing main with a literal zero, however, would not do it.)

There are other problems with it, though: support for sub dword [rax], edx appears to be lacking. With gas 2.25 on my Mac, it got assembled as sub dword [rax+4], edx , which is very wrong. The version of as that ships with Xcode refuses to assemble it, citing absolute 32-bit addressing use; gas 2.24.90 for Debian also refused to assemble it because there would be too many memory references, somehow. Because this is all incorrect, I'll stick with a nasm-assembled binary version of the shellcode instead of using pwnlib's asm to compile it.

Answer 2

What you're doing is very unusual and it looks like it requires a relocation that the Mach-O object format used by OS X doesn't support. The problem isn't that you're trying to use a label as an integer, it's that you're trying to use a label as an 8-bit integer. That's not very useful in practice, and something a compiler would never do.

If you really want to add only the lower 8 bits of the address of a symbol (or the difference between two symbols) to the lower 8 bits of RAX you're going to use the label as an 32-bit integer first.

For example you could move it into another 32-bit register first:

    mov $do_mov_rdi_rax, %ecx
    add %cl, %al
...
    mov $(do_syscall - do_mov_rdi_rax), %ecx
    add %cl, %al

If you don't have a free register for this than you load it from memory:

    add indirect_do_mov_rdi_rax, %al
...
    add indirect_difference, %al

indirect_do_mov_rdi_rax:
    .long   do_mov_rdi_rax

indirect_difference:
    .long   do_syscall - do_mov_rdi_rax

If didn't really want to be using 8-bit arithmetic and want to do the addition using all 64-bits of the address then you use the 64-bit register RAX instead:

    add $do_mov_rdi_rax, %rax
...
    add $(do_syscall - do_mov_rdi_rax), %rax