CODEWITHSUNDEEP
cexploit
Tigran
Tigran

Reputation: 1057

Program received signal SIGSEGV when writing to code section

I am hitting Program received signal SIGSEGV error when trying to override address of call instruction.
I store address of call argument (address 0x8048579) in eax and new value in edx (0xb7fb773a). Per my understanding instruction mov %edx,(%eax) should do that, but it fails.
What I am doing wrong?
This is part of my university task, so no real system is being hurt :-)

Code:

   0x08048566 <+35>:    mov    -0x8(%ebp),%edx
   0x08048569 <+38>:    mov    -0x4(%ebp),%eax
=> 0x0804856c <+41>:    mov    %edx,(%eax)    // Fails here.
   0x0804856e <+43>:    movl   $0x0,(%esp)
   0x08048575 <+50>:    call   0x8048370 <_exit@plt>

Registers:

eax            0x8048579    134514041   
edx            0xb7fb773a   -1208256710

Failure:

Program received signal SIGSEGV, Segmentation fault.
0x0804856c in foo (argv=0x58575655) at my_code.c:34

// Update 1: CPU info:

Architecture:          i686
CPU op-mode(s):        32-bit, 64-bit
Byte Order:            Little Endian
CPU(s):                1
On-line CPU(s) list:   0
Thread(s) per core:    1
Core(s) per socket:    1
Socket(s):             1
Vendor ID:             GenuineIntel
CPU family:            6
Model:                 69
Stepping:              1
CPU MHz:               2306.609
BogoMIPS:              4613.21
L1d cache:             32K
L1d cache:             32K
L2d cache:             6144K

Upvotes: 0

Views: 372

Answers (1)

Paweł Stankowski
Paweł Stankowski

Reputation: 160

Instruction mov %edx,(%eax) will indeed save EDX register value to memory address pointed by EAX.

This code fails because code section (.text) of ELF executable on Linux is not writable. Thus, writing to this section causes SIGSEGV signal from OS.

You may be interested in answers for this question: How can I make GCC compile the .text section as writable in an ELF binary?

Upvotes: 5

Related Questions