Is there a difference between the MASM shellcode and the NASM silk code

Question

I am new to StackOverflow. I recently started to learn assembly and is pretty new to assembly, completely new to shellcode. I use RadAsm to compile using the MASM assembler, and I tried to study the shellcode from this site, "Shelving for Linux and Windows"

I am using RadAsm for Windows 64-bit. The code I used is almost the same, except that I use the absolute name of the function, not the address of the function in the DLL. Silk code must use the wait function with parameter 5000 .

This is the code that I use in MASM.

 .386 .model flat, stdcall option casemap:none include kernel32.inc includelib kernel32.lib .code _start: xor eax, eax ; zero out eax mov ebx, Sleep ; function sleep goes in ebx mov ax, 5000 ; parameter goes in ax push eax ; parameter on stack call ebx ; call Sleep end _start end 

This happens without error in MASM.

The generated shellcode has zero values ​​and is slightly different from the website. This is as follows.

I used objdump -d nameofexecutable.exe for disassembly.

 Disassembly of section .text 00401000 <.text>: 401000: 33 c0 xor %eax,%eax 401002: bb 0e 10 40 00 mov $0x40100e,% 401007: 66 b8 88 13 mov $0x1388,%ax 40100b: 50 push %eax 40100c: ff d3 call *%ebx 40100e: ff 25 00 20 40 00 jmp *0x402000 

But there is no hex code 00 on the website.

 Disassembly of section .text: 08048080 <_start>: 8048080: 31 c0 xor %eax,%eax 8048082: bb ea 1b e6 77 mov $0x77e61bea,%ebx 8048087: 66 b8 88 13 mov $0x1388,%ax 804808b: 50 push %eax 804808c: ff d3 call *%ebx 

Maybe because I use x64 to compile or because I call the function indirectly?

Any help would be appreciated, thanks.

Answer 1

The simple answer: MASM sucks!

Quoted here "In the past, I developed a 32-bit shell code using the free open source Netwide Assembler (NASM), but when I went through the 64-bit diversity exercise, I decided that I would try it with Microsoft Assembler (MASM ). One of the problems quickly became apparent: MASM does not offer (what I know) to generate the source binary machine code as opposed to the .exe file! Everything is not lost, but code bytes can be extracted from the .exe file quite easily (but in the future I can go back to NASM). " It’s harder to create shellcode.

I used NASM to create a shellcode for a program that says that from the link you provided in x64 windows, this is the result I achieved, without null bytes. It turns out that the sleep example may not work correctly, but the second example is fully functional.

 "\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xeb\x2f\x59\x88\x51\x0a" "\xbb\x82\xf8\x60\x77\x51\xff\xd3\xeb\x31\x59\x31\xd2" "\x88\x51\x0b\x51\x50\xbb\xe6\x4d\x61\x77\x59\x31\xd2" "\x88\x51\x03\x31\xd2\x52\x51\x51\x52\x31\x32\xd2\x50" "\xb8\xca\x3a\x61\x77\xe8\xcc\xff\xff\xff\x75\x73\x65" "\x72\x33\x32\x2e\x64\x6c\x6c\x4e\xe8\xca\xff\xff\xff" "\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x41\x4e\xe8" "\xc6\xff\xff\xff\x48\x65\x79\x4e" 

NOTE: use the nameofexecutable.o with objdump

T. objdump -o nameofexecutable.o to get shellcode, not nameofexecutable.exe

Answer 2

Your code is compiled into 0x00401000, so the high byte of all addresses ends with 0x00. Their code is compiled into 0x08048080, so the high byte of all their addresses ends with 0x08.

That's where all your zeros come from.