6 ms·
On macOS, "gcc" puts strings that don't include a null byte in the TEXT section. I put quotes around gcc, since it seems that by default macOS aliases gcc to cl
by vivekseth 6y ago
On macOS, "gcc" puts strings that don't include a null byte in the TEXT section. I put quotes around gcc, since it seems that by default macOS aliases gcc to clang.
You can run the program I built here to see for your self: https://github.com/vivekseth/blog-posts/tree/master/Jump-Address-Hacking-to-Execute-Code-Stored-as-a-String https://github.com/vivekseth/blog-posts/tree/master/Jump-Add...
Since the string in the TEXT section, we can actually execute it as if it were code!
After you build the program you can run `otool -t ./a.out` to verify that the string `execString` is indeed in the TEXT section.
- tom_mellior 6y agoInteresting. And if you put a null byte at the end of that character array, it would put it in a different section? I don't have access to MacOS, but I would be interested in seeing the output of clang -S on that code (with and without a null byte), maybe you could add it to the repository?
- vivekseth 6y agoIf I'm remembering correctly (this was from 3 years ago), the string was moved to a different section if it had a null byte in the middle of the string. That's why coming up with the assembly I used was kinda tricky. Here's the output as-is: https://gist.github.com/vivekseth/20f319d2a9978af57d926b649adc0bde https://gist.github.com/vivekseth/20f319d2a9978af57d926b649a... Here's the output with a null byte in the middle: https://gist.github.com/vivekseth/fc50319aaac24588bcf568209bf6df8e https://gist.github.com/vivekseth/fc50319aaac24588bcf568209b... From what I can tell, it seems like both strings are in the TEXT section now. Maybe something changed, or I'm remembering incorrectly.