Creating Exploits

Creating Exploits¶

• Complex Instruction Set Computing (CISC)
• x86 and x86-64 use little-endian format

https://syscalls.mebeim.net/?table=x86/64/x64/latest

Call types¶

cdecl:
- Arguments pushed on the stack in reverse order. (right to left)
- EAX, ECX, and EDX are saved before the call execution
- Others registers are saved in the function
- This cleans up its own stack before returning

syscall:
- EAX, ECX, and EDX are not saved before call
- arguments are pushed right to left

stdcall:
- Arguments pushed on the stack in reverse order. (right to left)
- EAX, ECX, and EDX are saved before the call execution
- Return values are stored in the EAX register.
- The Callie cleans up the stack

__fastcall:
- Uses ECX and EDX, then stack for arguments passed from right to left.
- The MS version uses RCX, RDX, R8 and R9 then the stack
- The Callie cleans up the stack

__vectorcall:
- Large Vector types passed as registers

__thiscall
- ECX is a pointer to the this variable
- Arguments are pushed on to the stack in reverse order.
- The top of the stack is the first argument
- The Callie cleans up the stack

Default Linux and OSX Argument and return Values¶

Linux Syscall¶

List of Syscall Argument registers for Comp Architectures

x86 and x64:

x86 Instructions¶

• ret = pop rip

Stack¶

Here is how the stack is laid out in a function.

        ________________
ESP -> | .              |
       | .              |
       | .              |
       |________________|
       | Callee saved   |
       |  Registers     |
       | EBX, ESI & EDI |
       |   (as needed)  |
       |________________|
       | temporary      |
       | storage        |
       |________________|
       | local var #2   | [EBP - 8]
       |________________|
       | local var #1   | [EBP - 4]
       |________________|
EBP -> | Caller's EBP   |
       |________________|
       | Return Address | [EBP + 4]
       |________________|
       | Argument #1    | [EBP + 8]
       |________________|
       | Argument #2    | [EBP + 12] 
       |________________|
       | Argument #3    | [EBP + 16] 
       |________________|
       | Caller saved   |
       |  registers     |
       | EAX, ECX & EDX |
       | (as needed)    |
       |________________|

Stack pointer is stored on the stack and is overwritten with stack buffer overflow.

File tables¶

.dtors: destructor function table
.ctors: constructor function table
.got: global offset table
.plt: procedure linkage table

Shellcode¶

NOP sled can be hidden with @CABHKIJ. This is because these are the following instructions for this in order do not change the values of the registers.

Tools:
Shellcode in Golang