RE: Shellcode

["Dave Korn" <dave.korn () artimi com>]

Pedro E wrote:
> Hi All!
>
> I'm looking from some orientation to write a specific shellcode,
> I think that is a simple problem but I can find a solution.
> I have to execute a simple shellcode using hard coded addresses with a
> msgbox:
>
> LibraryReturn:
>        pop ecx                         ;get the library string
>        mov [ecx + 10], dl              ;MY PROBLEM is this line I don't
> have the right permissions to modify the NULL value and finish the string
>        mov ebx, 0x79470221             ;LoadLibraryA(libraryname);
>        push ecx                        ;beginning of user32.dll
>        call ebx                        ;eax will hold the module handle
>
>        jmp short FunctionName
>
> xxx
> ..
> ..
>
> GetLibrary:
>        call LibraryReturn
>        db 'user32.dllN'
>
> There is other way to set the null value? I can't modify the memory when i
> execute the shellcode.


  The .text section of a program is protected read-only when the executable
file image is loaded into memory.

  In the case of real buffer overflows, this is OK, because the shellcode is
on the stack, which is writeable.

  You need to place your shellcode into either the .data section, the heap (by
mallocing and copying it there), or the stack.

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....