When assembling a file with GNU assembler I get the following error:
hello.s:6: Error: invalid instruction suffix for `push'
Here's the file that I'm trying to assemble:
.text
LC0:
.ascii "Hello, world!\12\0"
.globl _main
_main:
pushl %ebp
movl %esp, %ebp
subl $8, %esp
andl $-16, %esp
movl $0, %eax
movl %eax, -4(%ebp)
movl -4(%ebp), %eax
call __alloca
call ___main
movl $LC0, (%esp)
call _printf
movl $0, %eax
leave
ret
What is wrong here and how do I fix it?
The problem is somewhat related to this question although errors and instructions in questions are different.
Prepend .code32 as your first line.
--32 option will change the target to 32 bit platform.
64bit instructions
By default most operations remain 32-bit and the 64-bit counterparts are invoked by the fourth bit in the REX prefix. This means that each 32-bit instruction has it's natural 64-bit extension and that extended registers are for free in 64-bit instructions
movl $1, %eax # 32-bit instruction
movq $1, %rax # 64-bit instruction
pushl %eax # Illegal instruction
pushq %rax # 1 byte instruction encoded as pushl %eax in 32 bits
pushq %r10 # 2 byte instruction encoded as pushl preceeded by REX
Are you assembling with a 64-bit assembler? Your code looks like it's 32-bit. I get this error with your code when using a 64-bit assembler:
example.s:6:suffix or operands invalid for `push'
But it works fine with a 32-bit assembler.
You have to use a "64 bit syntax", or you can use the " --32 " option: by this way the assembler chages its target to the i386 platform.
Related
.string "Hello\n"
.globl main
main:
pushl %ebp
movl %esp, %ebp
pushl $hello
call puts
movl $0, %eax
movl %ebp, %esp
popl %ebp
ret
This code works on 32bit Linux. How can I run this on Windows?
gcc hello.s
You need to find a Windows version of an x86 assembler. The GNU Assembler is available on Windows through the MinGW project. This is the same assembler you are using on Linux.
I'm trying to learn some stack overflow techniques and use shellcode in them.
I was able to successfully use some basic shellcodes. Then I started working on using exeve in assembly and invoke ls -l with that, again successful.
Now I am trying to use relative addressing and get rid of null values in my code. Because of that I tried a simple self-modifying code. I know code segment is read-only so I tried calling mprotect to make it writable. My code still doesn't work and I get segmentation fault at movb %al, 0x7(%esi). I really appreciate it if someone could give me some insight into the thing that is wrong in my code.
.text
.globl _start
_start:
jmp StartPoint
execvecall:
popl %esi # the address of string
#calling mprotect to make the memory writable
movl $0x7d, %eax
movl %esi, %ebx
movl $0x20, %ecx
movl $7, %edx
int $0x80
xorl %eax, %eax
movb %al, 0x7(%esi) #putting zero for at the end of /bin/ls
movb %al, 0xa(%esi) #putting another zero at the end of -l
#this part forms an array ending with for the second parameter of execve
movl %esi, 0xb(%esi)
movl %esi, %ebx
addl $8, %ebx
movl %ebx, 0xf(%esi)
movl %eax, 0x13(%esi)
movl %esi, %ebx
leal 0xb(%esi), %ecx
leal 0x13(%esi), %edx
movb $11, %al
int $0x80
StartPoint:
call execvecall
SomeVarHere:
.ascii "/bin/ls0-l0111122223333"
man mprotect says:
The implementation may require that addr be a multiple of the page size as returned by sysconf().
This is apparently the case on your machine. Assuming you have 4 KiB pages (as on x86, no PSE), you can round the address down by executing
and $0xfffff000, %ebx
after
movl %esi, %ebx
when preparing to call mprotect.
Note that calling mprotect changes the protection for the whole page.
The following x86 assembly code assembles fine, and it used to run flawlessly on my school's linux server, but when applying the same code to my linux virtual machine (ubuntu 14.04, all of a sudden it causes a segmentation fault.
Did stack conventions change, is this a GNU assembler problem? What memo did I miss?
I am running on a 64-bit machine, and this is a warm-up to building the backbone of an OS, so I need to be able to use the 16-bit real, 32-bit protected, and the 64-bit mode all in the same program. So I suppose what I really need is the little details about making all modes valid in the same program. I know to use .code16/32/64 when changing modes, but I guess what I'm missing (and can't seem to find in any OS tutorial, is how to do this on 64-bit architecture.
.code32
.text
.global _start
_start:
pushl $str1
pushl $len1
call print
addl $8, %esp <-cleans up the stack pointer
exit:
movl $1, %eax
movl $0, %ebx
int $0x80
print:
pushl %ebp
movl %esp, %ebp
movl $4, %eax
movl $1, %ebx
movl 12(%ebp), %ecx <- This is where the Seg Fault occurs according to GDB
movl 8(%ebp), %edx
int $0x80
popl %ebp
ret
.data
str1 : .ascii "String1\n"
len1 = . - str1
I'm guessing that you have a 64-bit machine, while your program is obviously 32-bit.
I have a 64-bit machine, if I compile it with this command, it fails, same line as you:
$ gcc -nostdlib test.s
However, if I compile a 32-bit executable:
$ gcc -nostdlib -m32 test.s
And all is fine.
Note that you may need some packages to be able to compile a 32-bit program in a 64-bit machine (g++-multilib or whatever they call it these days).
I have a basic asm program that checks if a string is a digit. I was adding in code to read from command line arguements, put it keeps seg faulting.
if what I have read is right, this should get the amount of arguments passed to the program, which should be stored in 0(%ebp). What am i doing wrong?
The entirity of the code can be found here: http://pastebin.com/kGV2Mxx4
The problem is the first 3-5 lines of _start.
upon Looking at lscpu's output, I have an i868 cpu. Although, it says it can operate in 32-bit and 64-bit. I am running 32 bit linux (Arch linux x86)
I fixed the issue. I did 2 pop's, one to bypass the programs name, the next to get the first argument. the updated code can be found here: http://pastebin.com/xewyeHYf
Can someone please tell me why I could not just do the following:
pushl 8(%ebp)
or
movl 8(%ebp), %eax
Here is a little tutorial I wrote on the subject:
NASM - Linux Getting command line parameters
You could write this:
_start:
b1: movl 0(%ebp), %eax
cmpl $1, %eax
je load_msg
b2: pushl 8(%ebp)
b4: call check
To understand why your previous attempts didn't work, draw stack diagrams.
Compile a small C program that does something like what you want to do, and compile it to assembly language to find out exactly how to access arguments. The x86_32 code doesn't look at all like any of the above, BTW:
int main(int argc, char *argv[])
{
return argv[1][0];
}
gives (yes, some is superfluous stack bookkeeping, but anyway):
.file "tst.c"
.text
.globl main
.type main, #function
main:
.LFB0:
.cfi_startproc
pushl %ebp
.cfi_def_cfa_offset 8
.cfi_offset 5, -8
movl %esp, %ebp
.cfi_def_cfa_register 5
movl 12(%ebp), %eax
addl $4, %eax
movl (%eax), %eax
movzbl (%eax), %eax
movsbl %al, %eax
popl %ebp
.cfi_restore 5
.cfi_def_cfa 4, 4
ret
.cfi_endproc
.LFE0:
.size main, .-main
.ident "GCC: (GNU) 4.7.2 20121109 (Red Hat 4.7.2-8)"
.section .note.GNU-stack,"",#progbits
movl %ebx, %esi
movl $.LC1, %edi
movl $0, %eax
call printf
I use the following asm code to print what is in EBX register. When I use
movl $1,%eax
int 0x80
and the echo $? I get the correct answer but segmentation fault in the first case. I am using the GNU Assembler and AT&T syntax. How can I fix this problem?
Judging by the code, you are probably in 64 bit mode (please confirm) in which case pointers are 64 bit in size. In a position-depended executable on Linux movl $.LC1, %edi is safe and what compilers use, but to make your code position-independent and able to handle symbol addresses being outside the low 32 bits you can use leaq .LC1(%rip), %rdi.
Furthermore, make sure that:
you are preserving value of rbx in your function
stack pointer is aligned as required
This code works for me in 64 bit:
.globl main
main:
push %rbx
movl $42, %ebx
movl %ebx, %esi
leaq .LC1(%rip), %rdi
movl $0, %eax
call printf
xor %eax, %eax
pop %rbx
ret
.data
.LC1: .string "%d\n"
Edit: As Jester noted, this answer only applies to x86 (32 bits) asm whereas the sample provided is more likely for x86-64.
That's because printf has a variable number of arguments. The printf call doesn't restore the stack for you, you need to do it yourself.
In your example, you'd need to write (32 bits assembly):
push %ebx
push $.LC1
call printf
add $8, %esp // 8 : 2 argument of 4 bytes