第一种,添加asm代码到c中,然后gcc编译生成可执行代码,最后objdump:
void main() {
asm{
…
}
}
太麻烦,这里就不详细介绍了,基本上包含在第二种方法中
第二种,直接用NASM或者GAS生成elf文件,然后objdump:
nasm -f elf print.asm
ld -m elf_i386 -o print print.asm
as test.asm -o test.o
ld test.asm -o test
objdump生成shellcode:
objdump -d print2 grep “^ ” cut -d$’\t’ -f 2 tr ‘\n’ ‘ ‘ sed -e ‘s/ *$//’ sed -e ‘s/ +/\x/g’ awk ‘{print “\x”$0}’
关于NASM和GAS的区别可以看:
https://www.ibm.com/developerworks/library/l-gas-nasm/
第三种,使用pwntools(https://github.com/Gallopsled/pwntools#readme)
example:
from pwn import *
code = """.global _start
_start:
jmp test1
test2:
pop ebx
mov al, 0xa
int 0x80
mov al, 0x1
xor ebx, ebx
int 0x80
test1:
call test2
.string "delfile" """
context(arch='x86', os='linux', endian='little', word_size=32)
shellcode = asm(code).encode('hex')
re = ''
while len(shellcode):
re += r'\x'+shellcode[:2]
shellcode = shellcode[2:]
print re<span data-mce-type="bookmark" style="display: inline-block; width: 0px; overflow: hidden; line-height: 0;" class="mce_SELRES_start"></span>
未完待补充