Welcome back to another video in this video.
Let's begin with writing exit code.
As mentioned earlier, this is the process that we are going to following almost all the cases.
But when writing a court, we are going to skip the first two steps because exit court is straightforward.
We know that Exeter's is going to be used so we can see the main page of exit is called Right Away,
and then we can write the assembly code.
So let's switch to our virtual machine and let's first create a directory called Shall Code.
Inside this exchange underscore sixty four directly
and let's navigate there before starting to write the code.
Let's check the main page of Exit Cisco.
If you notice the command I'm using manned space.
Two space exit man pages of Cisco can be read using man to be a typing man to space exit because exit.
This is what we are interested in.
Let's hit enter.
If you read the description, it says the function exit terminate the counting process immediately.
And if you see this here, the value status is returned to the parent process as the process exit status.
This is all you need to write the code.
We have two important things here.
One, we are going to use this exit function and it requires one argument which is going to be returned
as the exit status.
So what's our approach in writing the Shell code when writing code that says call number goes to the
register are a X and any argument that says call may have will go to the registers at the RSA are the
X are six or eight or nine respectively.
In this case we only have one argument.
So this argument goes into our design and the second number of this exit goes into our X.
Now let's find out the second number of exit I'm exiting from this man page output.
And let's find out the second number of exit Cisco numbers for 64 bit architecture can be found in the
final units to underscore 64 dot hedge.
So let's search for this file.
This is the five year interest rate, so let's copy this and let's take Cat and let's use grip and let's
grab for exit.
There it is, 60 is the skull number four exit system.
So our eggs should contain 60 and 80 should contain the argument for this column.
That's it.
So let's begin writing our shell code, using the information that we have gathered so far.
Let's create a file called Exit Dart.
Let's begin with the section text and let's write a global directive which says start and let's write
our entry point here and let's move the value of 60 into register artex.
We are moving the value 16 to ADEX because our eggs should contain.
This is called number of exit, which is 16.
We have also discussed that exit.
This call contains one argument, which is the exit status.
So let's move some value into add the register.
This can be any value and I am choosing this value to be two in this case.
So let's write move on the comma to.
Finally, let's take this call.
This is in.
So this will invoke the fiscal using the number that's placed in the ATX register, essentially we are
going to invoke Exeter's call with to ask the argument.
Now, let's save this file and let's assemble it using Nazeem exit dot nazan dash o exit dot o f l sixty
four.
Let's hit enter and let's link it using early exit or national exit.
Now if you execute this file it just exits.
But let's check the status.
As you can see, the written code, too, is getting printed in the States.
That means our assembly program worked.
Now let's try to dump the machine code from this Helft binary.
This can be done using object dump,
dash the exit.
And if you see the instructions there, an AT&T syntax.
My preference is internal syntax.
So let's use Widget, Daschle, Exit and Intel.
If you see the instructions are now being shown in Intel's index, it's just my preference and there
is no need to use internal syntax if you are comfortable with AT&T syntax.
Now, this is fine as far as the functionality of the exit program is considered.
But if you want to use this as a shell in your exploits, it may break because it has multiple NUL bytes
in its machine code.
You can see them here in the next video.
Let's try to fix our code to avoid these null bytes.