Create an arg array for execve on the stack

by

You can put the argv array onto the stack and load the address of it into rsi. The first member of argv is a pointer to the program name, so we can use the same address that we load into rdi.

xor edx, edx        ; Load NULL to be used both as the third
                    ; parameter to execve as well as
                    ; to push 0 onto the stack later.
push "-aal"         ; Put second argument string onto the stack.
mov rax, rsp        ; Load the address of the second argument.
mov rcx, "/bin//ls" ; Load the file name string
push rdx            ; and place a null character
push rcx            ; and the string onto the stack.
mov rdi, rsp        ; Load the address of "/bin//ls". This is
                    ; used as both the first member of argv
                    ; and as the first parameter to execve.

; Now create argv.
push rdx            ; argv must be terminated by a NULL pointer.
push rax            ; Second arg is a pointer to "-aal".
push rdi            ; First arg is a pointer to "/bin//ls"
mov rsi, rsp        ; Load the address of argv into the second
                    ; parameter to execve.

This also corrects a couple of other problems with the code in the question. It uses an 8-byte push for the file name, since x86-64 doesn’t support 4-byte push, and it makes sure that the file name has a null terminator.

This code does use a 64-bit push with a 4-byte immediate to push “-aal” since the string fits in 4 bytes. This also makes it null terminated without needing a null byte in the code.

I used strings with doubled characters as they are in the question to avoid null bytes in the code, but my preference would be this:

mov ecx, "X-al"     ; Load second argument string,
shr ecx, 8          ; shift out the dummy character,
push rcx            ; and write the string to the stack.
mov rax, rsp        ; Load the address of the second argument.
mov rcx, "X/bin/ls" ; Load file name string,
shr rcx, 8          ; shift out the dummy character,
push rcx            ; and write the string onto the stack.

Note that the file name string gets a null terminator via the shift, avoiding the extra push. This pattern works with strings where a doubled character wouldn’t work, and it can be used with shorter strings, too.

More Related Contents:

  1. Why NASM on Linux changes registers in x86_64 assembly
  2. Why do x86-64 instructions on 32-bit registers zero the upper part of the full 64-bit register?
  3. What’s the purpose of the LEA instruction?
  4. What considerations go into predicting latency for operations on modern superscalar processors and how can I calculate them by hand?
  5. Why does the x86-64 / AMD64 System V ABI mandate a 16 byte stack alignment?
  6. Why in x86-64 the virtual address are 4 bits shorter than physical (48 bits vs. 52 long)?
  7. Is a sign or zero extension required when adding a 32bit offset to a pointer for the x86-64 ABI?
  8. How to get c code to execute hex machine code?
  9. Printing floating point numbers from x86-64 seems to require %rbp to be saved
  10. MOVZX missing 32 bit register to 64 bit register
  11. CS:APP example uses idivq with two operands?
  12. Why are signed and unsigned multiplication different instructions on x86(-64)?
  13. What do the E and R prefixes stand for in the names of Intel 32-bit and 64-bit registers?
  14. Why is the address of static variables relative to the Instruction Pointer?
  15. Why is (or isn’t?) SFENCE + LFENCE equivalent to MFENCE?
  16. Distinguishing memory from constant in GNU as .intel_syntax
  17. Why does this MOVSS instruction use RIP-relative addressing? [duplicate]
  18. How to push a 64bit int in NASM?
  19. x64 instruction encoding and the ModRM byte
  20. Assembly registers in 64-bit architecture
  21. Why does the x86-64 GCC function prologue allocate less stack than the local variables?
  22. Bomb lab phase_4
  23. Does each PUSH instruction push a multiple of 8 bytes on x64?
  24. Can I add 64bit constants to 64bit registers?
  25. What does “rep; nop;” mean in x86 assembly? Is it the same as the “pause” instruction?
  26. x86-64 canonical address?
  27. Why can I access lower dword/word/byte in a register but not higher?
  28. What’s the best way to remember the x86-64 System V arg register order?
  29. Is reserving stack space necessary for functions less than four arguments?
  30. Can rip be used with another register with RIP-relative addressing?

Leave a Comment