Question

I need to find null-free replacements for the following instructions so I can put the following code in shellcode.

The first instruction I need to convert to null-free is:

mov ebx, str    ; the string containing /dev/zero

The string str is defined in my .data section.
The second is:

mov    eax,0x5a

Thanks!

Answer 1

Assuming what you want to learn is how assembly code is made up, what type of instruction choices ends up in assembly code with specific properties, then (on x86/x64) do the following:

1. Pick up Intel’s instruction set reference manuals (four volumes as of this writing, I think). They contain opcode tables (instruction binary formats), and detailed lists of all allowed opcodes for a specific assembly mnemonic (instruction name).
   Familiarize yourself with those and mentally divide them into two groups – those that match your expected properties (like, not containing the ‘x’ character … or any other specific one), and those that don’t. The 2nd category you need to eliminate from your code if they’re present.

2. Compile your code telling the compiler not to discard compile intermediates:

   gcc -save-temps -c csource.c

3. Disassemble the object file:

   objdump -d csource.o

4. The disassembly output from objdump will contain the binary instructions (opcodes) as well as the instruction names (mnemonics), i.e. you’ll see exactly which opcode format was chosen. You can now check whether any opcodes in there are from the 2nd set as per 1. above.

5. The creative bit of the work comes in now. When you’ve found an instruction in the disassembly output that doesn’t match the expectations/requirements you have, look up / create a substitute (or, more often, a substitute sequence of several instructions) that gives the same end result but is only made up from instructions that do match what you need.
   Go back to the compile intermediates from above, find the csource.s assembly, make changes, reassemble/relink, test.

6. If you want to make your assembly code standalone (i.e. not using system runtime libraries / making system calls directly), consult documentation on your operating system internals (how to make syscalls), and/or disassemble the runtime libraries that ordinarily do so on your behalf, to learn how it’s done.

Since 5. is definitely homework, of the same sort like create a C for() loop equivalent to a given while() loop, don’t expect too much help there. The instruction set reference manuals and experiments with the (dis)assembler are what you need here.

Additionally, if you’re studying, attend lessons on how compilers work / how to write compilers – they do cover how assembly instruction selection is done by compilers, and I can well imagine it to be an interesting / challenging term project to e.g. write a compiler whose output is guaranteed to contain the character ‘?‘ (0x3f) but never ‘!‘ (0x21). You get the idea.