Shellcode with restrictions

问题:

For a task I need to create simple shellcode, but it is not allowed that it contains \x80.

Notice: To make a system call on linux, like write or exit, you need among others this line: int 0x80, which in the end will produce shellcode including \x80.

Nevertheless I need to make system calls, so my idea now is to use a variable for the interrupt vector number. For example 0x40 and then multiply it with 2, so in the end there will be a \x40 but not a \x80 in the shellcode.

The problem is that the int is not taking a variable as an argument, I tried this for a test:

section .data

nr db 0x80

section .text

global _start

_start:

xor eax, eax
inc eax

xor ebx, ebx
mov ebx, 0x1

int [nr]

And get

error: invalid combination of opcode and operands

How could I get my idea working? Or do you have a different solution for the problem?

PS. sysenter and syscall are not working -> Illegal instruction

I am using nasm on a x86-32bit machine.

回答1:

maybe something like this, but never use it in serious code!

format ELF executable
use32
entry start

segment executable  writeable
  start:
  ;<some code>
  inc byte [ here + 1 ] ;<or some other math>
  jmp here
  here:
  int 0x7f
segment readable  writeable

(this is fasm-code)