I am writing shellcode on Ubuntu 11.10 x86 and the registers prior to the int 0x80 syscall look like this:
eax 0x66
ecx 0x8e60558
edx 0x0
ebx 0x3
which is set up for the connect() syscall. The value in the ecx register is an argument array that contains:
0x8e60558: 0x00000009 0x8e60583 0x00000010
where 0x00000009 is the file descriptor, 0x8e60583 is the server struct pointer that points to:
0x8e60583: 0x00000002 0x0000115c 0x7f000001
which is:
[address]: [AF_INET=2] [PORT=4444] [IP=127.0.0.1]
I know that the file descriptor is correct and all of the constant values set up in the registers like storing 0x66 in eax (socketcall is syscall #102) are correct to the best of my knowledge yet when I run the code, which should return the connected socket FD in the eax register, it returns:
eax: 0xffffff9b
which is obviously wrong. What I have I done incorrectly?
EDIT: Changed endianess of inet_address.
Your problem is that you are encoding the parameters to the connect syscall as little endian while some of them should be big-endian, additionally both the sin_family and sin_port members are encoded as 32bit, they should be 16 bit and that struct appears to require padding to 16 bytes.
PS You may want to use an assembler, you can always use objdump -x -D $binary to get the opcodes. Additionally I compile with gcc -c -x assembler-with-cpp -o hello-net.o hello-net.S && ld -o hello-net hello-net.o to be able to use the preprocessor as well.
PS2: You may want to try executing your code with strace, that shows the actual syscalls that you're making.
E.g. this test-program works for me (x86_64):
#include <asm/unistd.h>
#define AF_INET 2
#define SOCK_STREAM 1
hellostr:
.ascii "Hello world!\n" # 'Hello world!' plus a linefeed character
.equ helloLen, . - hellostr # Length of the 'Hello world!' string
.align 8
home_addr:
# AF_INET (native-endian)
.short AF_INET
# big-endian port 4444
.byte 0x11, 0x5c
# big-endian 127.0.0.1
.byte 0x7f, 0x00, 0x00, 0x01
# required padding to 16 bytes
.space 16 - (. - home_addr)
.equ home_len, . - home_addr
.globl _start
_start:
# syscall(SYS_socket, AF_INET, SOCK_STREAM, 0)
mov $__NR_socket, %rax
mov $AF_INET, %rdi
mov $SOCK_STREAM, %rsi
mov $0, %rdx
syscall
# syscall(SYS_connect, socket, [127.0.0.1:4444], sizeof(addr))
mov %rax, %rdi
mov $__NR_connect, %rax
mov $home_addr, %rsi
mov $home_len, %rdx
syscall
# syscall(SYS_write, socket, hellostr, strlen(hellostr))
mov $__NR_write, %rax
mov $hellostr, %rsi # Put the offset of hello in ecx
mov $helloLen, %rdx # helloLen is a constant, so we don't need to say
# mov edx,[helloLen] to get it's actual value
syscall # Call the kernel (syscall num in %rax)
mov $__NR_exit, %rax
xor %rdi, %rdi # Exit with return code of 0 (no error)
syscall
The same thing, but modified to get it working on x86 (32bit):
#include <asm/unistd.h>
#define AF_INET 2
#define SOCK_STREAM 1
#define SYS_SOCKET 1 /* sys_socket(2) */
#define SYS_CONNECT 3 /* sys_connect(2) */
hellostr:
.ascii "Hello world!\n" # 'Hello world!' plus a linefeed character
.equ helloLen, . - hellostr # Length of the 'Hello world!' string
.align 8
home_addr:
# AF_INET (native-endian)
.short AF_INET
# big-endian port 4444
.byte 0x11, 0x5c
# big-endian 127.0.0.1
.byte 0x7f, 0x00, 0x00, 0x01
# required padding to 16 bytes
.space 16 - (. - home_addr)
.equ home_len, . - home_addr
.align 8
sys_socket_args:
.int AF_INET
.int SOCK_STREAM
.int 0
.globl _start
_start:
# syscall(SYS_socketcall, SYS_SOCKET, {AF_INET, SOCK_STREAM, 0})
mov $__NR_socketcall, %eax
mov $SYS_SOCKET, %ebx
mov $sys_socket_args, %ecx
int $0x80
# syscall(SYS_socketcall, SYS_CONNECT, {socket, [127.0.0.1:4444], sizeof(addr)})
# Allocate 12 bytes of stack space (required for arguments to connect(2))
sub $12, %esp
mov %eax, (%esp) # sys_connect_args.fd = return-value
movl $home_addr, 4(%esp) # sys_connect_args.addr = &home_addr
movl $home_len, 8(%esp) # sys_connect_args.addrlen = sizeof(home_addr)
mov $__NR_socketcall, %eax
mov $SYS_CONNECT, %ebx
mov %esp, %ecx
int $0x80
# syscall(SYS_write, socket, hellostr, strlen(hellostr))
mov $__NR_write, %eax
mov (%esp), %ebx # socket-param = sys_connect_args.fd
mov $hellostr, %ecx # Put the offset of hello in ecx
mov $helloLen, %edx # helloLen is a constant, so we don't need to say
# mov edx,[helloLen] to get it's actual value
int $0x80 # Call the kernel (syscall num in %eax)
# restore stack
add $12, %esp
mov $__NR_exit, %eax
xor %ebx, %ebx # Exit with return code of 0 (no error)
int $0x80
Edit: Expanded the first paragraph to mention two other possible errors and added a 32 bit (x86) sample that works for me.