Hello, my name is Stephen.
And in this lecture let's delve into the concept of relative addressing a technique that leverages the
current location in relation to the RIP register.
So this approach is valuable as it enables us to avoid relying on hardcoded addresses within our assembly
code.
So the process is remarkably straightforward.
So we can achieve this by employing the Lia, which is load effective address instruction with the format
like the.
Leah.
Destination.
And after that, we will also give the rel rel source.
Right.
Source.
So with this here, the Rel instruction in this computes the address of the source relative to the IP
register.
So to implement this we must define our variables before the code itself.
So this definition should precede the current location of the IP register and otherwise, if it's situated
too far away, the variable's value will be truncated and the remainder of register will be filled with
zeros.
So now let's take the next step and enhance our shell code using the relative address technique to precisely
locate the Hello World String.
So we will declare the entry point of the program as start.
So global.
Sorry.
Here global start here.
We will create a text section containing the actual program code section text.
Text here.
So we will first start here.
So we will start the program executing from this label.
So GMP cut.
Here we are jumping to the code label, which we will define now.
And also in this section we will need to define the Hello world to declare a null terminated string.
Uh, now.
Here.
It will also create a Hello world.
Hello, world.
String.
And what will it?
Containers.
Hello, world.
Now we will also declare it with this null termination here.
0XA And after that we will create our code label.
This is the main code section for our program.
Code here and here.
We will not create this with our tab here.
So because this is the label, the labels writes this way in assembly.
So now we will create our instructions to prepare Siskel to print the string.
So mov al uh, here mov al one which is the with this here we are telling the assembly to load the Siskel
number for.
Right.
Which is Siskel number one into the al register.
Now we will clear the register with x or so our x or die.
Here are the I.
Now we are clearing the register, which is a file descriptor zero for the standard output.
And we will add the we will set the RTI to one, we will set the RTI to one and we will load the address
of Hello World into RC, which is the pointer to the string.
So Leah, as I said, we will use this Leah here, RC the RL and Hello World.
With this.
Here we are loading the address of Hello World into RSA.
As I said, and we will use XOR here again, which is for clearing the RDX register.
RDX, RDX here, RDX.
And after that we will set the RDX to 12 because this is the length of the string.
Hello world and.
Are the X here and 12.
Also after Hello World, we also have this new line which and also the null terminated string here.
So that's why it is 12.
If the count is one, two, three, four, five, six, seven, eight, nine, ten, 11.
And we also have the 12 here.
And after that we will perform the syscall to print the string syscall.
And here after that, we will need.
To, uh, to prepare the fiscal to exit our program.
And in order to do that, we will use clear the racks, register with X or racks here racks.
And we are we are going to add the racks 60.
We are setting the racks to 60, which is this.
This is the fiscal number for exit and we will use the X or racks or no racks, the die or die.
Uh, with clearing the register, which is this is the exit status zero.
And after that we will perform the syscall to exit the program.
Syscall here.
That's it.
Now, our Start label is declared as the program's entry point execution begins at this label here.
And we also have the GMP code.
This instruction jumps to the code label and effectively skipping the Hello World label for now.
And the Hello World label is a null terminated string containing the Hello world followed by a new line
character 0XA and the code label marks the main part of the program where the actual code execution
takes place and the first block of our instruction.
Prepares a syscall to print the string.
MOV al one.
Sets the value of al register to one which corresponds to the syscall number for the write system.
Call and SDA are the I sometimes recall this as RDA or RDA.
So RDA RDA here clears the RDA register which will be used to specify the file descriptor and this is
the zero for standard output and RDA add RDA one sets the RDA to one indicating standard output and
as I said, explained this in this lecture.
You learned that in this lecture the l e a so l e rsi rel Hello World loads the address of Hello World
string into the RSI register and.
And we also have the RDX, RDX.
This clears the RDX register, which will be used to specify the length of the string to be printed.
And also we have the RDX and RDX 12, which as I explained, which is the length of the string.
Hello world.
New new line character.
And we also have the syscall executes the write syscall printing the string to the console.
And the second block of our instruction prepares a syscall to exit the program.
So x or x rax clears the rax register which will hold the syscall number.
And this is for the 60 to exit and add rax 60 sets the rax to 60, indicating the syscall number for
exit and X or clears the RDA register which will be used to specify the exit status in this case.
And after that, as always, syscall executes the exit syscall terminating the program.
Now let's actually compile and assemble our this assembly language code.
Now and after that, you will see what's what we changed here with our programs.
Logic so Nasm f elf 64.
Hello dot hsm dot HSM here and hello world dot all here.
And as you can see we got some warnings but don't worry about that.
We have our code working.
Okay here.
So hello world dot.
All here and all.
Hello world.
Hello.
Yeah.
Well.
And now we will use the as you can see, we have the Hello world here again.
La la la la la.
Just created.
Now here.
Now what we're going to do is we will use the Objdump again and you will see the interesting things
here.
So M Intel, Hello world here.
And that's it.
We have no bad characters at all.
So now let's try it as a shell code and let's see what will change here.
Objdump Oh, actually we can also let's actually write it from zero here.
We know how to do that, right?
So objdump m Intel the hello world here grep.
Hello, world.
Grab.
Crap.
Zero nine.
A f.
Here.
And grab the file.
And cut.
F to d.
Here you will use this code every time you you create a new shell code here.
So save this command somewhere so you don't have to write it all again.
It's not a short command.
Right?
So cut.
And after that?
Yeah.
After cutting the F to D, we need to cut the FF177 here.
Seven.
And after that the here.
He r.
S.
TR.
Tears here and.
They are.
No.
Yeah, they are.
He and.
Here.
Set.
S no backslash here.
And dollar sign.
Where is my dollar?
Yeah.
Dollar sign.
Double slash.
Like this.
G.
And after that we will use the set.
S here.
The slash slash here.
This.
X this year.
And after that we will write G here and we will paste the here.
As.
Hmm.
I think we didn't close some of the schools we opened here.
So let's analyze it.
Yeah.
The problem is, I believe it's here.
We need to add another code here, and that's it.
And as you can see, here, we have.
This.
Here.
So it starts with A, B or C.
It also have a 35.
Yeah.
And this is our shell code.
And as you can see here, we do not have any bad characters at all here.
So the bad characters, you learn that bad characters in previous lectures.
So 000A, f, F0D and we do not have those, luckily.
So because we wrote our program exceptionally good.
So what are we going to do here is we will code that to our C plus plus program, not C plus plus the
C program here.
You might get.
Oops.
No.
Yeah.
And as you can see, we have some warning here.
This is an escaped backslash.
At the end of the string is not portable.
I believe.
Let's actually check this again.
Why this tells us here.
Teachers.
So tr.
S s.
And.
Airlines.
Space characters.
TR.
Oh, yeah, we have this error here.
That's it.
And as you can see here, we don't have that warning anymore.
But actually we didn't change this anything at all in our shell code.
But it's okay to write the nice code without warnings here, right?
So that's it.
We got we got the same results still here, but I don't want to use.
So this warning here and yeah, we had some type of error here.
So now let's actually copy this into our C code here.
Now.
In order to do that.
And as you can see here in previous code here, we have lots of bad characters.
So now we will copy this here and that's it.
Here.
So now let's go to here.
It's actually use this terminal in our Visual Studio.
Clear.
So we don't have to switch that over time.
Or let's actually use stick to the traditions here.
So now what we're going to do is we will run compile this here with F No, no FPI, F, no stack.
Protector.
The exact stack.
And.
Hello, world.
That's.
Hey, where.
Where is our mate?
No, it's.
It's main.cpp.
Mean.
Not CP.
Actually, it's as you can see, we have our file name is Main CP, but it doesn't matter for the GCC
here if your file name is here.
So let's actually change this name to main dot CP, But actually let's change this from the Visual Studio
code here because.
Oh, turns out we.
Can change it here.
Yeah.
rMe.
Main.cpp.
Main.cpp here.
Main.c.
No.
And we main dot cpp Main.c and sunos.
Why don't we have the.
No, we don't have this main.cpp here.
Why is that?
It should be somewhere sheltered.
Maybe we deleted that accidentally.
That's actually.
Create a new.
Main dot C here.
And copy this here.
And the same code.
And as you can see, we will not change anything in our code.
And now can we actually increase the size of this and the terminal size?
No.
I believe we can from the settings.
But now instead of increasing it, let's actually use this terminal here.
Stick to the traditions.
And we have we should have the Hello world, the main dot see here.
Right.
Yeah, I think we move this somewhere or do it.
So now what we're going to do is.
Now we will.
Geek.
F no stack.
Protector the exec stack here and main dot C here main dot c Yeah we have exec start ignored here.
We know that we did that on purpose and now the final thing here and now we have the shell code length.
We have the segmentation fault at the shell code 51 here.
Let's actually see what happened here.
We probably have that bad characters again.
So.
One.
One, two, three.
Why we have that.
Let's actually find another place.
Search for slash back slash and replace to new line.
No.
Regular expression.
Find and place New line.
And don't we have Internet?
Yeah, sure, we can do that.
I think from the regular expressions here.
And I think I did that correct in previous example here.
So we will search for the.
Slashes not for apparent and regular expression.
And here.
We will change to New line.
Or we can also enable the regular expression, change the access to new line.
And that's it.
And.
As you can see here, we have the bad character in here.
This is f f, which is mentioned as bad character.