int main ()
{

  char *argv[3] = {"/bin/sh","-i","/dev/tty",NULL};
  execve("/bin/sh",argv,NULL);

  return 0;
}

c程序运行正常.然后我尝试编写我的测试程序(修改为推送null)：

#include<stdio.h>
int main(){
    __asm__(
            "xor    %rdx,%rdx\n\t"   //rdx is the third argument for execve,null in this case.
            "push   %rdx\n\t"
            "mov    -8(%rbp),%rdx\n\t"
            "mov    $0x692d,%rdi\n\t" //$0x6924 is 'i-'
            "push   %rdi\n\t"         //push '-i' to the stack
            "lea    -16(%rbp),%rax\n\t"    //now rax points to '-i'
            "mov    $0x31b7f54a83,%rdi\n\t" //the address of /bin/sh
            "push   %rdi\n\t"                //push it to the stack              
            "push   %rdx\n\t"                //end the array with null
            "mov    $0x31b7e43bb3,%rdi\n\t"  //the address of "/bin/sh"
            "push   %rdi\n\t"              //push the address of "/dev/tty to the stack
            "push   %rax\n\t"              //push the address of '-i' to the stack
            "mov    $0x31b7f54a83,%rdi\n\t"
            "push   %rdi\n\t"              //push the address of /bin/sh again to the stack
            "mov    %rsp,%rsi\n\t"         //rsi now points to the beginning of the array
            "mov    -24(%rbp),%rdi\n\t"   //rdi now points to the addresss of "/bin/sh"
            "mov    $0x3b,%rax\n\t"               // syscall number = 59
            "syscall\n\t"
    );
    }

我在这里有内存中字符串的地址,我们可以假设它们不会改变.但是我们没有字符串’-i’的地址.所以我在这里做的是将参数推送到堆栈中,如下所示：

Low                  ------------------------------------------------------------------             High

|addressof"/bin/sh"(rsi points to here)|addressof"-i"|addressof"/dev/ssh"|addressof"/bin/sh"(rdi points to here)|-i|

它没用.程序编译正常但是当我运行该程序时,没有任何反应.

我不熟悉汇编,我对参数的传递方式有一些担忧,例如,编译器如何知道argv参数何时在内存中结束？

编辑

感谢Niklas B的以下建议,我使用了trace来查看execve是否实际运行.我得到execve(0x31b7f54a83,[0x31b7f54a83,“ – i”,0x31b7e43bb3,0x31b7f54a83,0x692d],[/ * 0 vars * /])= -1 EFAULT(错误地址),这意味着第二个参数传递错误.我推入堆栈的所有东西都被认为是argv参数的一部分！

在我将空值推入堆栈后,strace给出execve(0x31b7f54a83,0x31b7e43bb3],[/ * 0 vars * /])= -1 EFAULT(错误地址).只有当地址是字符串时,这非常接近正确答案…

感谢Brian,我现在看到问题出在哪里.硬编码地址位于另一个程序的共享库中.因此,该程序在实际输入该程序之前不应运行.谢谢大家,我会尽快更新.如果问题解决了,我会将其标记为已解决.