last day (24 days later) » 

8:53 PM
0
Q: passing an argument outside of registers

trogneI'm trying to pass a second argument to my ls command, ls -a -l, but without using a register. Here, the address of -a argument is at esi. I want to place -l somewhere in memory, but not a register. I've tried with the stack, but lea esp, [esp-18] does not place the address on the stack. Instea...

 
First of all, don't access under the stack pointer. Second, lea does not access memory so it can't possibly put the value into esp. Third, you most definitely do not want to use esp as destination for that lea. Pick some other register that you can then push.
 
I know it works with another register. But how can I add an argument when I'm out of registers ?
 
You are not out of registers. But if you were, you could of course put the arguments on the stack one by one reusing a register.
 
But what I push to the stack, is the value of the argument, not the memory address. If I reuse esi, how can it reference 2 memory address. In my example, I push esi for the argument -a
Can you show the solution for my code ? With 2 arguments for esi ? esi points to the memory of the first argument. How can I push a memory location of a 2nd argument ?
 
Load a register with address of last argument, push to stack. Load same register with address of preceding argument, push to stack. Continue backwards.
 
8:53 PM
This is not working. push 0x0000612d ; -a push 0x00006c2d ; -l mov esi, esp. It must be an array of memory address. But how ? If esi is the address to the first argument, how can I use the same register for a second argument ?
 
push 0x0000612d; push 0x00006c2d; lea esi, [esp+4]; push esi; sub esi, 4; push esi;
 
It's not working... I do other push on stack , like push edi, push ebx... push 0x0000612d push 0x00006c2d lea esi, [esp+4] push esi sub esi, 4 push esi push eax push edi push ebx mov ecx, esp ... push esi before push ebx but it won't work either !
 
You are missing the NULL terminator for the argv array. Not sure what eax and edi hold, one of those could be it. You need to push that right on top of the last argument address (that is before the first push esi).
 
For example :
    push eax
    push edi ; 0000
    push 0x0000612d ; args...
    push 0x00006c2d
    lea esi, [esp+4]
    push esi
    sub esi, 4
    push esi ; location of array of args
    push ebx ; location of /bin/ls (1st arg of argv)
    mov ecx, esp ; ecx is for argv
Some pushes corrupt my ecx
my final ecx
 
if edi is the NULL then you need to push that just before the first push esi
to terminate the argv array
 
8:54 PM
ecx reads needs first ebx, then esi, then edi
 
push 0x0000612d ; args...
push 0x00006c2d
lea esi, [esp+4]
push edi  ; if edi==NULL
push esi
sub esi, 4
push esi ; location of array of args
push ebx ; location of /bin/ls (1st arg of argv)
mov ecx, esp ; ecx is for argv
 
GREAT
    push eax
    push edi ; 0000
    push 0x0000612d ; args...
    push 0x00006c2d
    lea esi, [esp+4]
    push eax
    push esi
    sub esi, 4
    push esi ; location of array of args
    push ebx ; location of /bin/ls (1st arg of argv)
    mov ecx, esp ; ecx is for argv
comparing with your code...
ok, eax is null too
awesome !
 
not sure what you need the first two NULLs on the stack for but whatever
 
it's edi, last argument of execve, an array of environment vars
here it's empty, I don't use them
But I were to use edi ...
if I were to use edi, it would be possible with this same technique ?
because with "push 0x0000612d" , I kill my edi
mmm... I could to esp+8 for edi ?
I think edi goes there :
    push eax
    push 0x0000612d ; args...
    push 0x00006c2d
    lea esi, [esp+4]
    push eax
    push edi ; 0000
    push esi
    sub esi, 4
    push esi ; location of array of args
    push ebx ; location of /bin/ls (1st arg of argv)
    mov ecx, esp ; ecx is for argv
between push eax and push esi
anyway thank you very much !
 

last day (24 days later) »