Hello, my name is Stephen.
And now we will talk about a new technique on how to deal with the string's address, which is the GMP
call technique.
So this technique is simply for we need to make first make the GMP instruction to the string.
We want to move to a specific register.
After that we call the actual code using the call instruction, which pushes the strings address to
the stack.
Then we pop the address into that register.
Now when you look at this code, when we write, you will understand it better and you will understand
it fully here.
So now we will create a new text file.
And actually let's instead of creating.
So we have the shell code here.
Let's.
Shellcode.
And in this shellcode let's actually save this in our shellcode here.
Our system is.
Somehow I wrote here.
So yes.
Save as in assembly, not assembly source shell code.
And here we will name it.
Uh, hacked here.
So.
Or yeah had hacked here and that.
Because we will first live right here.
And as you can see here, you didn't have an extension for debugging.
We don't need debugging.
We are doing it manually because we are professionals.
Right.
And what we're going to do is we will use the declare the entry point of the program as the start.
So global start and section text.
This is for the text section containing the actual program code.
And here we will the program will start executing from this label.
So that's why we write this start here.
And after that we will use the GMP, which is a string.
We will add the string here, which means that with this we are jumping to the string label and we also
we will also create here the code label, which.
Ma We will mark at it like the main code section here and we will pop the RSI first layer, which is
the pop.
With this here we are popping the return address of our.
A string label and into our RSI.
So.
And also we will move a.
One.
We are doing this to load the fiscal number for write into al.
Actually, let's use this here.
Yeah.
And after that we will xor rti rti.
With this we are clearing the RDR register for standard output and now we will add the add the RTI one.
We are setting the RTI to one which is the file descriptor for standard output and x or are they x?
Are the x here with this here we are clearing the register, which is the length of the string and we
will add the RDX here again.
And this is the this is going to be.
No, actually.
So our string length is going to be let's actually firstly create a string length here.
String.
So the string label marks a string generation section here.
So we will call the code here and.
Without this here.
Yeah.
And now what we're going to do is we will create our string.
Name it here.
So let's name it hacked.
A is here and we will need to be.
And hacking.
Success.
Or let's actually write malware injected.
And after that we will use the null parameter string here.
We will declare that with this and that's it.
And here what we're going to do is we will add our the X.
And here we will make it.
Let's actually count it.
One, two, three, four, five, six, seven, eight, nine, ten, 11, 12, 13, 14, 15, 16.
So and with this, we have the 17 here with null terminated string.
It counts 17.
And what we're going to do is we will call the syscall to perform the syscall to print the string syscall
here and XOR rex racks.
This is for clearing the rax register, which is this.
And also we will add the set the rax to 60 for the syscall number for exit at rax 60 and we will clear
the register.
Are the I here?
Also.
And after that we will perform the syscall to exit the program.
Cisco.
So that's it with our assembler code here.
Now, as you can see here, we created the call code, Hello World DB and we also ended with null terminated
string.
So let's actually make it a little bit nicer with spaces here.
Delete the.
And this is our spaces here and that's it.
So now let's explain this code deeper.
And so let's start with the Start label.
And this Start label is declared as the program's entry point.
Execution begins in this at this label.
And we also have the GMP string instruction with this GMP string instruction jumps to the string label
as firstly essentially skipping this code section here.
And the code section contains the main code that performs the Shell code's functionality.
And with this here Pop RSI is used to pop the value of the return address, which is the address of
this of this hacked str.
Uh, which and this is the also label from the stack into the rc rc register.
And the value will be used as a pointer to the string and the sequence of instructions starts with the
mov al one and ending with the second cycle.
Here.
This performs the syscall to print the malware injected string to the console and the sequence instruction
after the syscall sets up the syscall exit program.
So and after that we have this string label here.
This marks the section where the string generation occurs and we have the call code is used to call
the code section here, effectively executing the code that prints the malware injected string into
the console.
And here we.
With this label hacked STR and DB malware injected with this.
Here we are declaring the null terminated string.
Malware injected.
So we have the jump instructions here we use the JMP and call instructions are used for control flow
jumping to different parts of the code and we use syscalls here.
This code demonstrates how to use x86 64 Linux syscalls for writing the to the console, which is write
and exiting the program which is exit as we used here Ida and our Rex Rex Rex and we use the register.
So we use various registers here a l r, c, r, d RDX and a x rex.
So we are we use this to pass arguments and perform the Syscalls and here we also generated the.
Null terminated string and we used its address for output.
And now what we're going to do is we will assemble our assembly code here In order to do that, actually
let's create our GDB, which I opened previously here for testing purposes.
Now we will.
And as you can see, we have this Hector ASM and now we will call the Nasm f 64.
So we will name it.
Let's, let's get Hector ASM or Hector object file and that's it.
So.
Now here an Netwide assembler is used to assemble this assembly code and Flif here specifies the output
format as 64 bit elf which is executable and linkable format, which is the format used for most executables
on Linux systems.
And with this here, this is the input assembly code file and this all is object specifies the output
object file which is named Hacksaw, where the assembled machine code will be saved and now we will
link to the object file.
In order to do that, we will use the LD here.
So LD.
Hack.
That all here output file is going to be.
Hacked.
So Aldi is a G and new linker used to link object files into executables and this hacked dot object
file generated from the assembly code.
This is the object file here.
We firstly created in with this here ESM assembler here.
And this with this dot o parameter we are specifying the output executable file name.
Then we are specifying the output executable file name as hacked here.
And now let's actually use this.
Sorry.
Yeah.
And as you can see here, we are printing this malware injected.
So.
Now what we're going to do is we will disassemble the code.
So objdump here.
The Intel hacked.
So that's it.
As you can see here, Objdump is a utility that displays information about object files and executables,
including disassembly of machine code.
And with here we are specifying that the disassembly output should be displayed and m Intel here specifying
we are with this here we are specifying that the output format as Intel style assembly language and
this is the name of the executable file to disassemble.
Now running these commands will assemble the assembly code and link it into executable and then display
the disassembled machine code in Intel style assembly language using the Objdump utility.
So this allows you to see the actual machine instructions that corresponds to your assembly code.
And our journey has led us to a significant milestone.
This is a shellcode that's free from troublesome characters.
Now let's recap our accomplishments.
So to start, we implemented a JMP instruction to navigate to the string.
Subsequently, we employed the call instruction to execute the actual code, and this call instruction
triggers the subsequent instruction to be pushed onto the stack.
Now let's take a closer look within the GDB.
Let me actually check if my voice is recording.
Yeah, perfect.
Now what we're going to do is we will not clear actually, so we will open the new tab, see data source
Shellcode here unless we have the hex here.
So what we're going to do is we will use a GDB.
Hello?
No, no.
Hello.
No hacked here and here.
We need to set the disassembly flavor to Intel syntax.
So set.
Disassembly.
This.
Assembly flavor.
Or Intel.
So this command configures gdb to use Intel style assembly syntax for disassembly.
Now we also need to break set a breakpoint at this start label.
So set.
Yeah.
No, actually, in order to set breakpoint, we will use break start.
And as you can see, we have the breakpoint at a 4010 zero zero.
4010 zero zero.
So as you can see here, we have set the break breakpoint in here in the start section of our no in
the text section, in the start phase of our program in the start label.
And now what we're going to do is let's actually.
Quarter here and.
We will run this code.
Run.
And as you can see, we are we are in this breakpoint.
So this command here, this run command starts the execution of the program and stops at this Start
label due to the breakpoint we defined here and now what we are going to do.
We will use a step here.
So this command executes one instruction at a time and provides you with the assembly and register information
for that instruction.
So now let's use that several times and let's see what happens.
So.
And that's it.
So by using this step command, you are moving through the program on one assembly instruction at a
time.
So one, two, three, four, five, six, seven.
Right.
So one, two, three, four, five, six, seven.
Not actually from here.
One, two, three, four, five, six, seven.
And this is the cycle.
And as you can see, we printed.
And after that, this is the exit code of our assembly program.
So as you continue to use this step command, you will be able to see how the control flow progresses
and how each instruction modifies registers and memory.
So this step by step analysis is a great way to gain a deeper understanding of how your assembly code
is executed and how the program's behavior evolves.
Now we will use this layout.
So as you can see, this program is not being run because it's already executed and exited normally
without any errors.
Now, what we're going to do is we will run this program again.
And as you can see, we had a breakpoint here.
So now we will use the layout.
Layout.
You will love this here.
So that's it, right?
This is what we wanted here.
So this command sets up the assembly layout, allowing to view the assembly code and corresponding source
code side by side in this GDB interface.
So this can be incredibly helpful for understanding the relationship between the assembly instructions
and high level source code.
With this layout you can easily follow the flow of the instructions as you step through the program's
execution.
So by entering this layout you have activated and activated the assembly layout and you should now see
the assembly code on the left side of this GDB interface and any corresponding source code on the right
side.
And this layout enables you to track the execution of instructions while simultaneously observing the
context of your code in this source file.
So.
Now what we're going to do is we will let's actually use the step here step.
And as you can see, we are jumping, right?
So step E after this syscall.
Then that's because this program malware injected and this program exited normally.
Now.
What are we going to do is.
We will run this program again.
Run.
And.
Sexually acquitted?
Yes.
Run it again.
Break at start and layout.
And run.
Here.
Yeah.
Now what we're going to do is here we will need to analyze it deeper.
And now.
Let's actually use the step I.
So we are at this here and this one.
We also have this B row here and this.
The with this plus means break point here.
And we jumped from here to here.
Right.
Where with using the GMP here.
And here the output, as you can see here, the looks like this.
And there's a some interesting things we need to discover here.
Right.
So.
What are we going to do Here is.
As you can see.
Xor we also.
Let's actually step in again.
Step.
Oops.
Yeah.
Step.
Here.
We need to see this.
So you don't have to write the step every time just by entering pressing enter.
You can call the step here.
No assemble available because the program is having have already run here.
And as you can see here, after the start.
The address of our tagged str, which is also called the malware injected, but we will call it hacked
STR because this is the variable name and not the value.
And this address of this hacked STR string is pushed into the stack and the next instruction is somewhere
pop RC here which moves the address of the hello.
No, the which moves the heart address of the malware injected string from the stack to the RC register.
Now in the next lecture we will create this shellcode and we will execute it within the C program.
And I'm waiting you in next lecture.
So and this is it with our program and and exciting times lie ahead in our shellcode exploration and
in this in next lecture also I want to tell you that we will delve into the intriguing process of generating
and executing our meticulously crafted Shellcode.
Together, we will witness the practical implementation of the concepts we have been mastering so far,
and I'm eagerly anticipating our next section where we will dive into the realm of live execution and
see our shellcode in action.
Until then, feel free to prepare any questions or ideas you would like to discuss further.
See you in the next lecture.