Bad characters are characters that have the potential to disrupt the execution of a shellcode as they
might be interpreted as something different.
For instance, consider the case of zero zero here.
Here after three two.
Right.
So which denotes as a zero value, right.
So however it gets, it gets interpreted as null terminator leading to premature string termination,
as you learned in assembly language training.
So to illustrate this, let's revisit the previous code snippet here.
So now let's go here.
So as you can see here, when we execute our program here, we get the my Shell code length 27.
And after that we got the segmentation fault.
So in this case, we need to be investigating in the shell code number 27 as the hexadecimal here.
So let's go there actually and count it from zero to number 27.
So each one of these counts as one.
So.
One, two, three, four, five.
Actually in array mode.
Of course it comes from the zero.
But in this case, we will count from.
Uh.
Yes, let's.
Let's actually count it from zero.
Avon.
0123, four, five, six, seven, eight, nine, ten, 11, 12.
13, 14, 15.
16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26 and 27.
And here we go.
It's not.
Yeah, I think you saw it, right?
Yeah.
Here.
And after three two, we have this null string terminator.
Actually, it's not a new string terminator, but our code like assumes it is.
So these are we we we can also call this the problematic characters in Shellcode development.
So there's a four main bad characters or problematic, problematic characters here.
The zero zero which we have here is the zero value or null Terminator, which as you can see, this
is zero.
So this represents the zero value or null Terminator.
And we also have the line feed.
So zero A we have the form feed f f the indicating the form feed, and we also have the signifying carriage
return, which is zero.
So if we change this zero zero here, oops, not here.
Please, just I don't want to save it.
So if we change this zero zero to from like, let's actually zero, one, two, three, four and four
here, zero zero.
Remember it was 36, right?
Yeah.
Zero zero.
And let's compile our program again and you will see something different here.
And as you can see here, we have the my shell code length.
So we have the segmentation fault.
Again, because of that, we change this, Right?
So I'm not sure if I remember that.
Let's actually copy this again.
Yeah.
It was 64, 62, 36.
62 what?
Yeah, 62.
36.
So now how can we eliminate these troublesome characters from our shell code so we can achieve this
by employing our current knowledge of assembly?
You learned that in previous lectures, remember?
So this involves selecting which part of registers content should we depend on the data size being moved?
For instance, if we intend to move a small value like 15 to the Rax register, we can use move 15 here,
but now.
We will write our assembly code from zero so it will be better for us.
So as everyone say, instead of editing a sample, just write it from zero for a small project.
Of course.
So now what we're going to do is we will, uh, let's actually come back our explorer here.
So we will open the shell code.
New file.
Hello, Dot ASM.
That's it.
So what we're going to do is.
And we will, as I said, we instead of, for instance, if we need intend to move a small value like
15 to the racks register, we can use the move al 15 here instead of using the racks.
So but now what we're going to do is and alternatively, arithmetic operations can also be utilized,
for example, to achieve the same result.
We can use x or x or racks racks here and we will add the racks.
15 Right?
So now let's delve into our machine code examining one instruction at a time.
So but before that here, let's actually write our assembly code and get that machine code again from
our assembly code.
So this will be a better way to understand and learn the way of the things work.
So what we're going to do is we will firstly global start here section text, oops, global start.
So and after that section text here.
So move al as I said, one x or I actually use tabs.
So x or the I here again or the I.
So tabs.
Here.
Uh, here.
And we will add the.
One move the RSI.
Here.
Hello.
Well.
So actually, let's also define the data section.
Let's actually in this time, let's actually define the data section after.
So hello world.
Section data.
Section data here and Hello world.
We have.
This is going to be string.
Hello, world.
And you will see instead of using zero, we will use 0XA.
Right and length is going to be equal dollar sign minus Hello world.
Not worth just a word.
And here.
So that's it.
Now, we will also move the length to RDX.
Length here and we will call the Cisco, and after that we will exit from the program here.
Racks.
60 and move.
Or the one after that, let's actually call the Cisco again.
So that's it with our program.
Now, we can what is here is this.
Yeah.
Now we can also close this.
Yeah, we have this here.
So let's go back to here.
Let's actually save.
Save our main.cpp.
So we will change the shellcode anyway.
So.
Now we will compile this first link here.
F elf64.
Hello dot RSM.
Output is.
Hello dot.
Hello world dot o here now we will hear.
Hello world dot o here.
Let's actually get the executable file.
Hello.
Well.
Yeah, that's it.
We have this here.
Hello, world.
Let's actually run it.
Hello, world.
And as you can see, we have printed the Hello world here.
That's basic.
So now what we're going to do is we will objdump d m Intel.
Hello, world.
Oops, not this Hello world.
And that's it.
So.
Now, as you can see here.
Right.
We have the text data and we yeah, we have text and data here.
So we managed to remove all the bad characters from our shell code, which leaves us with how to deal
with addresses when copying strings.
Right?
So now let's actually.
Again.
Get the shell code of our program here.
So we have this.
Let's actually, instead of writing from it's zero.
Let's actually just copy it.
Objdump.
Hello.
Notice here.
Objdump.
Hello, world.
What was the.
Executable name.
Objdump.
Hello, world.
And this is our Shellcode.
We also have this zero zero here, and you will see why we have this.
That's it almost.
Yeah.
And also.
Yes.
Yeah.
Now.
Let's run this again.
And that's because we got this without problem.
And as you can see here, we got the segmentation for the segmentation fault.
And we have the.
Ararat, Shellcode 11, which which is here.
And in next lecture you will learn about how to fix that with relative address technique.
I'm waiting you in next lecture.