Well, this is where we left off in the previous video.
Now let's try to fix this animal rights issue first.
Let's copy this exit, not Nazan and let's say he does exit dash no nul not Nazan.
No, let's open this exit Dasht.
No, no not Nazem and work on this file instead.
Let's first clear these two registers by placing zero in them.
We can do something like this more are X comma zero and move the AI comma zero.
So we are just clearing the registers.
However, these two move instructions are going to cause null bytes once again.
Let's try to change them.
Let's assemble and linked this file nazem exit dasht no null not nazan bargepole exit Dasch no null
dot o f sixty four early exit Dasch.
No no not all national exit Dasch no null and hit enter.
No.
Let's once again try running object done on this to take a look at the machine code.
Here it is.
If you notice the move X and move area instructions are actually causing a lot of null bytes.
If you remember I have discussed about our instruction.
One popular technique to avoid null bytes is to guard the register with itself.
If you use Addicks comma eggs, the machine code will not contain any rights, but we will still have
the value zero into attacks.
Similarly, we can use the same technique with Oduye register.
So let's open our exit dasht no null Darwinism once again and let's try to fix that part first.
So let's remove this more instruction and let's replace that with God IREX cosmonautics and let's also
change this second instruction to how things are.
All right, so we have got our common area and our idea, common idea and quickly going to assemble
and link it once again and we are going to execute object dump.
But check if those nailbiter are remote.
Look at that.
These two instructions do not have any metal bytes anymore.
Now we will have to deal with the next two instructions.
Now, ATX and Ideato, this does contain the values Xeros.
Now all we have to do is we have to use the same register of our eggs to place this value zero x three,
which is decimal 60.
Similarly, we can use a sub register of this idea to place this value to in the register.
Don't get confused with this eggs and area here.
Probably because of this assembler optimization Harrex is replaced with eggs.
An idea is replaced with Eddi.
So let's open this file once again.
And let's use air comma 60 and the L comma to.
Let me show you the 64 bit registers before we assemble and link this program, if you remember, Al
is the lowest, a bit sad register of attacks register.
So we are using this to avoid null votes.
Similarly for ardia, BHL is the lowest a bit register.
So we are using this register to place their exit status.
So that's the reason why we are using and register and be and register.
Let's switch back to our washing machine and let's assemble and link this file.
Let's once again use object to check if these Nele whites are removed, Dirigo, there are no nail biters
at all in this final machine called No, let's run the alpha binary and observe the exit status
exit.
Nash, no null.
There it is, the program is still working, so we have avoided all the non VIPs and we still managed
to keep the functionality of this program as is.
Now, let's run this through GDP and not if everything is working as expected.
So I'm just using GDP, not exit Dasch normal.
And let's set up a breakpoint at underscore start, which is the entry point, and let's run this binary.
The first instruction is that our eggs are eggs.
So after executing this instruction, our eggs should contain zero.
Similarly, the idea idea is going to place the value zero into our deregister.
In this case, these registers already have the value of zero, but generally it is a good practice
to clear the registers before using them for any operations.
So let's do a quick assay twice and we should observe zeros being there even after this.
Dirigo are still has zero idea, still has zero.
Now the next instruction is to move zero X 3C into the register.
And let's type aside.
And once this instruction is executed, we should see this value in attacks register.
Let's go back to the registers and look at that zero.
Tracy is now placed in our X register.
Finally, we are moving this value zero x two into this BHL register, so let's step aside and we should
see the value to in the register.
Here it is.
Oduye registered now contains the value to finally.
We are executing the instructions iscan which is going to execute exit Swisscom.
So let's step aside.
And if you see the process exited with code zero two, that's expected.
That means our program is working as expected.
Everything looks fine, and congratulations on writing your first program to produce custom shall code.
Now, if you want to use the cell code in your exploit from this program, we can simply copy the codes
that are seen in the object dump output.
Let me quickly show that let's execute the object dump.
Come on.
Once again, if you want to copy the shell code from this particular binary and if you want to use that
in your exploits, we can simply copy these bytes from here.
So the shell code becomes slash, exfoliate, slash X 31, slash X C0, slash X 48, slash X 31, slash
x f, which is the next three bytes.
And after that we are going to copy these two bytes, which is going to be slash X, be zero, slash
X 3C.
Similarly, the next three bytes will be slash four zero seven zero two and then slash zero slash 05.
This is how we can simplify the financial code that can be used in our exploits.
Of course, this can be automated using some commands which are already available online.
So let's quickly search for one such command to extract shell code being shown using our object tool.
So this is going to use a quick Google search extract shall code from binary.
The first link is what I'm going to use.
Here it is.
I'm just going to copy this, this command automatically extract the entire shell code from our program
using object and a couple of other Linux command line utility, like said, grep, cut and paste.
So I'm just copying it here and I'm going to pass it here.
And I just replace this dot slash program using our exit dasht.
No, no binary.
All right.
So let's hit enter and look at that.
We have gotten the exact same shell code that we have manually copied here.
Right.
If you see this slash exfoliated 31 C0 slash X 48 31 C0, this is how we can write very basic shell
code.
Of course, you may not want to use this code itself in your exploits and you probably are interested
in something like reverse shell code or exactly been a shell code.
We are going to discuss those in the next few lectures, but I hope this video has given you a basic
idea of how we can start writing shall code.
In the next video we are going to discuss exec BHL called.