>>1530Thanks.
I got to level 5 and I tried doing what I found in the article.
When I compiled shellcode.c on my computer and tried to analyse it using gdb as the article recommended, I got some weird shit for the execve function.
(I hope you don't mind intel syntax)
(gdb) disassemble __execve
Dump of assembler code for function execve:
0x0806c470 <+0>: push ebx
0x0806c471 <+1>: mov edx,DWORD PTR [esp+0x10]
0x0806c475 <+5>: mov ecx,DWORD PTR [esp+0xc]
0x0806c479 <+9>: mov ebx,DWORD PTR [esp+0x8]
0x0806c47d <+13>: mov eax,0xb
0x0806c482 <+18>: call DWORD PTR ds:0x80ea9f0
0x0806c488 <+24>: cmp eax,0xfffff000
0x0806c48d <+29>: ja 0x806c491 <execve+33>
0x0806c48f <+31>: pop ebx
0x0806c490 <+32>: ret
0x0806c491 <+33>: mov edx,0xffffffe8
0x0806c497 <+39>: neg eax
0x0806c499 <+41>: mov ecx,DWORD PTR gs:0x0
0x0806c4a0 <+48>: mov DWORD PTR [ecx+edx*1],eax
0x0806c4a3 <+51>: or eax,0xffffffff
0x0806c4a6 <+54>: pop ebx
0x0806c4a7 <+55>: ret
End of assembler dump.
I don't see any interrupts.
Also, I tried disassembling the function that is called and got this, which is even weirder:
(gdb) disassemble ds:0x80ea9f0
No symbol table is loaded. Use the "file" command.
(gdb) disassemble 0x80ea9f0
Dump of assembler code for function _dl_sysinfo:
0x080ea9f0 <+0>: inc eax
0x080ea9f1 <+1>: lock push es
0x080ea9f3 <+3>: or BYTE PTR [eax],ah
End of assembler dump.