shellcode error Segmentation fault (core dumped)

Question

im new at shellcoding i try to write a shellcode for ( hello world ) so this is my first code with nulled bytes :

global _start

section     .text

_start:                                         ;tell linker entry point

    mov     edx,len                             ;message length
    mov     ecx,msg                             ;message to write
    mov     ebx,1                               ;file descriptor (stdout)
    mov     eax,4                               ;system call number (sys_write)
    int     0x80                                ;call kernel

    mov     eax,1                               ;system call number (sys_exit)
    int     0x80                                ;call kernel

section     .data

msg     db  'Hello, world!',0xa                 ;our dear string
len     equ $ - msg                             ;length of our dear string

and this is my second code after i remove null x00 !!

global _start

section     .text

_start: 
                                            ;tell linker entry point
    xor     edx,edx     
    mov     dl,len                             ;message length
    mov     ecx,msg                             ;message to write
    xor     ebx,ebx
    mov     bl,1                               ;file descriptor (stdout)
    xor     eax,eax
    mov     al,4                               ;system call number (sys_write)
    int     0x80                                ;call kernel
    xor     eax,eax
    mov     al,1                               ;system call number (sys_exit)
    int     0x80                                ;call kernel

section     .data

msg     db  'Hello, world!',0xa                 ;our dear string
len     equ $ - msg                             ;length of our dear string

i compile it to test by :

nasm -f elf32 -o hello-without-null.o hello-without-null.asm

ld -o hello-without-null hello-without-null.o

its work when i run it ./hello-without-null

than i used : objdump -d hello-without-null -M intel

and this is the result :

Disassembly of section .text:

08048080 <_start>:
 8048080:   31 d2                   xor    edx,edx
 8048082:   b2 0e                   mov    dl,0xe
 8048084:   b9 9c 90 04 08          mov    ecx,0x804909c
 8048089:   31 db                   xor    ebx,ebx
 804808b:   b3 01                   mov    bl,0x1
 804808d:   31 c0                   xor    eax,eax
 804808f:   b0 04                   mov    al,0x4
 8048091:   cd 80                   int    0x80
 8048093:   31 c0                   xor    eax,eax
 8048095:   b0 01                   mov    al,0x1
 8048097:   cd 80                   int    0x80

then i convert it to shellcode by :

objdump -d ./hello-without-null|grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|sed 's/ /\x/g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g'

the output is :

"\x31\xd2\xb2\x0e\xb9\x9c\x90\x04\x08\x31\xdb\xb3\x01\x31\xc0\xb0\x04\xcd\x80\x31\xc0\xb0\x01\xcd\x80"

when i test it i got this error :

Shellcode Length: 25 Segmentation fault (core dumped)

my c code for testing :

#include<stdio.h>
#include<string.h>

unsigned char code[] = \
"\x31\xd2\xb2\x0e\xb9\x9c\x90\x04\x08\x31\xdb\xb3\x01\x31\xc0\xb0\x04\xcd\x80\x31\xc0\xb0\x01\xcd\x80";

int main()
{

        printf("Shellcode Length:  %d\n", strlen(code));

        int (*ret)() = (int(*)())code;

        ret();


}

so what is the problem ?? and how i can solve it ?

Answer 1

i solve it by changing

char shellcode[]

to

const char shellcode[]

and using using the JMP/CALL/POP method