Search code examples
linuxassemblyx86attshellcode

AT&T 32-bit assembly does pushing strings after function call works?

im currently trying to understand a AT&T 32-bit assembly code and i've stumbled upon these instructions and im trying to make sense out of them:

_start:
        jmp B

A:
   # fd = open("libtest.so.1.0", O_RDONLY);
   xorl %ecx, %ecx
   movb $5, %al
   popl %ebx
   xorl %ecx, %ecx
   int $0x80


B:
   call A
   .string "/lib/libtest.so.1.0"

A goes on for abit longer but it doesn't matter, my problem is within B, how is it possible to push the string after the call instruction was made? i don't see any way the string ended up in ebx other than some sort of argument passing i don't understand yet.

Solution

  • call pushes the return address on stack, i.e. the address following the call, which would be the address of the path string here.

    Normally a ret would then pop that off and return control to the caller, but here the code pops the address into ebx and uses it as a parameter for the interrupt.