How to write machine language commands directly to ELF executable

2

I'm currently using NASM to take some assembly code commands, make a .o file, and then using ld to link it to an ELF executable. My assembly file ok.asm:

section .text
   global _start     ;must be declared for linker (ld)

_start:             ;tells linker entry point
   mov  edx,len     ;message length
   mov  ecx,msg     ;message to write
   mov  ebx,1       ;file descriptor (stdout)
   mov  eax,4       ;system call number (sys_write)
   int  0x80        ;call kernel

   mov  eax,1       ;system call number (sys_exit)
   int  0x80        ;call kernel

section .data
msg db 'Hello, world!', 0xa  ;string to be printed
len equ $ - msg     ;length of the string

Then nasm -f elf ok.asm which generates ok.o

Then ld -m elf_1386 -s -o yo ok.o to generate the finished product.

The problem is that I want to be able to test out pure machine language (not necessarily assembly) without any dependencies to build and link it, like NASM and LD. All I have available is the ability to write (/generate) pure bytes into a file, so I would like to take the machine language pure commands (I can take care of that part) and write it to an executable .ELF format (the part I need help with).

If I object dump it I can get some idea of the architecture. First objdump -x ./yo (to get the header info):

x ./yo

./yo:     file format elf32-i386
./yo
architecture: i386, flags 0x00000102:
EXEC_P, D_PAGED
start address 0x08048080

Program Header:
    LOAD off    0x00000000 vaddr 0x08048000 paddr 0x08048000 align 2**12
         filesz 0x0000009d memsz 0x0000009d flags r-x
    LOAD off    0x000000a0 vaddr 0x080490a0 paddr 0x080490a0 align 2**12
         filesz 0x0000000e memsz 0x0000000e flags rw-

Sections:
Idx Name          Size      VMA       LMA       File off  Algn
  0 .text         0000001d  08048080  08048080  00000080  2**4
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
  1 .data         0000000e  080490a0  080490a0  000000a0  2**2
                  CONTENTS, ALLOC, LOAD, DATA
SYMBOL TABLE:
no symbols

Now objdump -s ./yo to get the contents:

s yo

yo:     file format elf32-i386

Contents of section .text:
 8048080 ba0e0000 00b9a090 0408bb01 000000b8  ................
 8048090 04000000 cd80b801 000000cd 80        .............   
Contents of section .data:
 80490a0 48656c6c 6f2c2077 6f726c64 210a      Hello, world!.  

Pretty sure that ".text" section contains the pure machine code bytes generated from the above commands (e.g., mov edx, len ;etc)

And when I read it byte-for-byte in JavaScript along with the string, I get this (360 lines, one line for each byte, first line number, then byte in base 2, then charCode, then actual char):

000: 01111111, 127: \u007f
001: 01000101, 069: E
002: 01001100, 076: L
003: 01000110, 070: F
004: 00000001, 001: \u0001
005: 00000001, 001: \u0001
006: 00000001, 001: \u0001
007: 00000000, 000: \u0000
008: 00000000, 000: \u0000
009: 00000000, 000: \u0000
010: 00000000, 000: \u0000
011: 00000000, 000: \u0000
012: 00000000, 000: \u0000
013: 00000000, 000: \u0000
014: 00000000, 000: \u0000
015: 00000000, 000: \u0000
016: 00000010, 002: \u0002
017: 00000000, 000: \u0000
018: 00000011, 003: \u0003
019: 00000000, 000: \u0000
020: 00000001, 001: \u0001
021: 00000000, 000: \u0000
022: 00000000, 000: \u0000
023: 00000000, 000: \u0000
024: 10000000, 128: \u0080
025: 10000000, 128: \u0080
026: 00000100, 004: \u0004
027: 00001000, 008: \u0008
028: 00110100, 052: 4
029: 00000000, 000: \u0000
030: 00000000, 000: \u0000
031: 00000000, 000: \u0000
032: 11001000, 200: È
033: 00000000, 000: \u0000
034: 00000000, 000: \u0000
035: 00000000, 000: \u0000
036: 00000000, 000: \u0000
037: 00000000, 000: \u0000
038: 00000000, 000: \u0000
039: 00000000, 000: \u0000
040: 00110100, 052: 4
041: 00000000, 000: \u0000
042: 00100000, 032:
043: 00000000, 000: \u0000
044: 00000010, 002: \u0002
045: 00000000, 000: \u0000
046: 00101000, 040: (
047: 00000000, 000: \u0000
048: 00000100, 004: \u0004
049: 00000000, 000: \u0000
050: 00000011, 003: \u0003
051: 00000000, 000: \u0000
052: 00000001, 001: \u0001
053: 00000000, 000: \u0000
054: 00000000, 000: \u0000
055: 00000000, 000: \u0000
056: 00000000, 000: \u0000
057: 00000000, 000: \u0000
058: 00000000, 000: \u0000
059: 00000000, 000: \u0000
060: 00000000, 000: \u0000
061: 10000000, 128: \u0080
062: 00000100, 004: \u0004
063: 00001000, 008: \u0008
064: 00000000, 000: \u0000
065: 10000000, 128: \u0080
066: 00000100, 004: \u0004
067: 00001000, 008: \u0008
068: 10011101, 157: \u009d
069: 00000000, 000: \u0000
070: 00000000, 000: \u0000
071: 00000000, 000: \u0000
072: 10011101, 157: \u009d
073: 00000000, 000: \u0000
074: 00000000, 000: \u0000
075: 00000000, 000: \u0000
076: 00000101, 005: \u0005
077: 00000000, 000: \u0000
078: 00000000, 000: \u0000
079: 00000000, 000: \u0000
080: 00000000, 000: \u0000
081: 00010000, 016: \u0010
082: 00000000, 000: \u0000
083: 00000000, 000: \u0000
084: 00000001, 001: \u0001
085: 00000000, 000: \u0000
086: 00000000, 000: \u0000
087: 00000000, 000: \u0000
088: 10100000, 160:  
089: 00000000, 000: \u0000
090: 00000000, 000: \u0000
091: 00000000, 000: \u0000
092: 10100000, 160:  
093: 10010000, 144: \u0090
094: 00000100, 004: \u0004
095: 00001000, 008: \u0008
096: 10100000, 160:  
097: 10010000, 144: \u0090
098: 00000100, 004: \u0004
099: 00001000, 008: \u0008
100: 00001110, 014: \u000e
101: 00000000, 000: \u0000
102: 00000000, 000: \u0000
103: 00000000, 000: \u0000
104: 00001110, 014: \u000e
105: 00000000, 000: \u0000
106: 00000000, 000: \u0000
107: 00000000, 000: \u0000
108: 00000110, 006: \u0006
109: 00000000, 000: \u0000
110: 00000000, 000: \u0000
111: 00000000, 000: \u0000
112: 00000000, 000: \u0000
113: 00010000, 016: \u0010
114: 00000000, 000: \u0000
115: 00000000, 000: \u0000
116: 00000000, 000: \u0000
117: 00000000, 000: \u0000
118: 00000000, 000: \u0000
119: 00000000, 000: \u0000
120: 00000000, 000: \u0000
121: 00000000, 000: \u0000
122: 00000000, 000: \u0000
123: 00000000, 000: \u0000
124: 00000000, 000: \u0000
125: 00000000, 000: \u0000
126: 00000000, 000: \u0000
127: 00000000, 000: \u0000
128: 10111010, 186: º
129: 00001110, 014: \u000e
130: 00000000, 000: \u0000
131: 00000000, 000: \u0000
132: 00000000, 000: \u0000
133: 10111001, 185: ¹
134: 10100000, 160:  
135: 10010000, 144: \u0090
136: 00000100, 004: \u0004
137: 00001000, 008: \u0008
138: 10111011, 187: »
139: 00000001, 001: \u0001
140: 00000000, 000: \u0000
141: 00000000, 000: \u0000
142: 00000000, 000: \u0000
143: 10111000, 184: ¸
144: 00000100, 004: \u0004
145: 00000000, 000: \u0000
146: 00000000, 000: \u0000
147: 00000000, 000: \u0000
148: 11001101, 205: Í
149: 10000000, 128: \u0080
150: 10111000, 184: ¸
151: 00000001, 001: \u0001
152: 00000000, 000: \u0000
153: 00000000, 000: \u0000
154: 00000000, 000: \u0000
155: 11001101, 205: Í
156: 10000000, 128: \u0080
157: 00000000, 000: \u0000
158: 00000000, 000: \u0000
159: 00000000, 000: \u0000
160: 01001000, 072: H
161: 01100101, 101: e
162: 01101100, 108: l
163: 01101100, 108: l
164: 01101111, 111: o
165: 00101100, 044: ,
166: 00100000, 032:
167: 01110111, 119: w
168: 01101111, 111: o
169: 01110010, 114: r
170: 01101100, 108: l
171: 01100100, 100: d
172: 00100001, 033: !
173: 00001010, 010:
174: 00000000, 000: \u0000
175: 00101110, 046: .
176: 01110011, 115: s
177: 01101000, 104: h
178: 01110011, 115: s
179: 01110100, 116: t
180: 01110010, 114: r
181: 01110100, 116: t
182: 01100001, 097: a
183: 01100010, 098: b
184: 00000000, 000: \u0000
185: 00101110, 046: .
186: 01110100, 116: t
187: 01100101, 101: e
188: 01111000, 120: x
189: 01110100, 116: t
190: 00000000, 000: \u0000
191: 00101110, 046: .
192: 01100100, 100: d
193: 01100001, 097: a
194: 01110100, 116: t
195: 01100001, 097: a
196: 00000000, 000: \u0000
197: 00000000, 000: \u0000
198: 00000000, 000: \u0000
199: 00000000, 000: \u0000
200: 00000000, 000: \u0000
201: 00000000, 000: \u0000
202: 00000000, 000: \u0000
203: 00000000, 000: \u0000
204: 00000000, 000: \u0000
205: 00000000, 000: \u0000
206: 00000000, 000: \u0000
207: 00000000, 000: \u0000
208: 00000000, 000: \u0000
209: 00000000, 000: \u0000
210: 00000000, 000: \u0000
211: 00000000, 000: \u0000
212: 00000000, 000: \u0000
213: 00000000, 000: \u0000
214: 00000000, 000: \u0000
215: 00000000, 000: \u0000
216: 00000000, 000: \u0000
217: 00000000, 000: \u0000
218: 00000000, 000: \u0000
219: 00000000, 000: \u0000
220: 00000000, 000: \u0000
221: 00000000, 000: \u0000
222: 00000000, 000: \u0000
223: 00000000, 000: \u0000
224: 00000000, 000: \u0000
225: 00000000, 000: \u0000
226: 00000000, 000: \u0000
227: 00000000, 000: \u0000
228: 00000000, 000: \u0000
229: 00000000, 000: \u0000
230: 00000000, 000: \u0000
231: 00000000, 000: \u0000
232: 00000000, 000: \u0000
233: 00000000, 000: \u0000
234: 00000000, 000: \u0000
235: 00000000, 000: \u0000
236: 00000000, 000: \u0000
237: 00000000, 000: \u0000
238: 00000000, 000: \u0000
239: 00000000, 000: \u0000
240: 00001011, 011: \u000b
241: 00000000, 000: \u0000
242: 00000000, 000: \u0000
243: 00000000, 000: \u0000
244: 00000001, 001: \u0001
245: 00000000, 000: \u0000
246: 00000000, 000: \u0000
247: 00000000, 000: \u0000
248: 00000110, 006: \u0006
249: 00000000, 000: \u0000
250: 00000000, 000: \u0000
251: 00000000, 000: \u0000
252: 10000000, 128: \u0080
253: 10000000, 128: \u0080
254: 00000100, 004: \u0004
255: 00001000, 008: \u0008
256: 10000000, 128: \u0080
257: 00000000, 000: \u0000
258: 00000000, 000: \u0000
259: 00000000, 000: \u0000
260: 00011101, 029: \u001d
261: 00000000, 000: \u0000
262: 00000000, 000: \u0000
263: 00000000, 000: \u0000
264: 00000000, 000: \u0000
265: 00000000, 000: \u0000
266: 00000000, 000: \u0000
267: 00000000, 000: \u0000
268: 00000000, 000: \u0000
269: 00000000, 000: \u0000
270: 00000000, 000: \u0000
271: 00000000, 000: \u0000
272: 00010000, 016: \u0010
273: 00000000, 000: \u0000
274: 00000000, 000: \u0000
275: 00000000, 000: \u0000
276: 00000000, 000: \u0000
277: 00000000, 000: \u0000
278: 00000000, 000: \u0000
279: 00000000, 000: \u0000
280: 00010001, 017: \u0011
281: 00000000, 000: \u0000
282: 00000000, 000: \u0000
283: 00000000, 000: \u0000
284: 00000001, 001: \u0001
285: 00000000, 000: \u0000
286: 00000000, 000: \u0000
287: 00000000, 000: \u0000
288: 00000011, 003: \u0003
289: 00000000, 000: \u0000
290: 00000000, 000: \u0000
291: 00000000, 000: \u0000
292: 10100000, 160:  
293: 10010000, 144: \u0090
294: 00000100, 004: \u0004
295: 00001000, 008: \u0008
296: 10100000, 160:  
297: 00000000, 000: \u0000
298: 00000000, 000: \u0000
299: 00000000, 000: \u0000
300: 00001110, 014: \u000e
301: 00000000, 000: \u0000
302: 00000000, 000: \u0000
303: 00000000, 000: \u0000
304: 00000000, 000: \u0000
305: 00000000, 000: \u0000
306: 00000000, 000: \u0000
307: 00000000, 000: \u0000
308: 00000000, 000: \u0000
309: 00000000, 000: \u0000
310: 00000000, 000: \u0000
311: 00000000, 000: \u0000
312: 00000100, 004: \u0004
313: 00000000, 000: \u0000
314: 00000000, 000: \u0000
315: 00000000, 000: \u0000
316: 00000000, 000: \u0000
317: 00000000, 000: \u0000
318: 00000000, 000: \u0000
319: 00000000, 000: \u0000
320: 00000001, 001: \u0001
321: 00000000, 000: \u0000
322: 00000000, 000: \u0000
323: 00000000, 000: \u0000
324: 00000011, 003: \u0003
325: 00000000, 000: \u0000
326: 00000000, 000: \u0000
327: 00000000, 000: \u0000
328: 00000000, 000: \u0000
329: 00000000, 000: \u0000
330: 00000000, 000: \u0000
331: 00000000, 000: \u0000
332: 00000000, 000: \u0000
333: 00000000, 000: \u0000
334: 00000000, 000: \u0000
335: 00000000, 000: \u0000
336: 10101110, 174: ®
337: 00000000, 000: \u0000
338: 00000000, 000: \u0000
339: 00000000, 000: \u0000
340: 00010111, 023: \u0017
341: 00000000, 000: \u0000
342: 00000000, 000: \u0000
343: 00000000, 000: \u0000
344: 00000000, 000: \u0000
345: 00000000, 000: \u0000
346: 00000000, 000: \u0000
347: 00000000, 000: \u0000
348: 00000000, 000: \u0000
349: 00000000, 000: \u0000
350: 00000000, 000: \u0000
351: 00000000, 000: \u0000
352: 00000001, 001: \u0001
353: 00000000, 000: \u0000
354: 00000000, 000: \u0000
355: 00000000, 000: \u0000
356: 00000000, 000: \u0000
357: 00000000, 000: \u0000
358: 00000000, 000: \u0000
359: 00000000, 000: \u0000

Also a simple hexdump command yields the following:

    hexdump -C -n 360 ./yo
00000000  7f 45 4c 46 01 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  02 00 03 00 01 00 00 00  80 80 04 08 34 00 00 00  |............4...|
00000020  c8 00 00 00 00 00 00 00  34 00 20 00 02 00 28 00  |........4. ...(.|
00000030  04 00 03 00 01 00 00 00  00 00 00 00 00 80 04 08  |................|
00000040  00 80 04 08 9d 00 00 00  9d 00 00 00 05 00 00 00  |................|
00000050  00 10 00 00 01 00 00 00  a0 00 00 00 a0 90 04 08  |................|
00000060  a0 90 04 08 0e 00 00 00  0e 00 00 00 06 00 00 00  |................|
00000070  00 10 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  ba 0e 00 00 00 b9 a0 90  04 08 bb 01 00 00 00 b8  |................|
00000090  04 00 00 00 cd 80 b8 01  00 00 00 cd 80 00 00 00  |................|
000000a0  48 65 6c 6c 6f 2c 20 77  6f 72 6c 64 21 0a 00 2e  |Hello, world!...|
000000b0  73 68 73 74 72 74 61 62  00 2e 74 65 78 74 00 2e  |shstrtab..text..|
000000c0  64 61 74 61 00 00 00 00  00 00 00 00 00 00 00 00  |data............|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000f0  0b 00 00 00 01 00 00 00  06 00 00 00 80 80 04 08  |................|
00000100  80 00 00 00 1d 00 00 00  00 00 00 00 00 00 00 00  |................|
00000110  10 00 00 00 00 00 00 00  11 00 00 00 01 00 00 00  |................|
00000120  03 00 00 00 a0 90 04 08  a0 00 00 00 0e 00 00 00  |................|
00000130  00 00 00 00 00 00 00 00  04 00 00 00 00 00 00 00  |................|
00000140  01 00 00 00 03 00 00 00  00 00 00 00 00 00 00 00  |................|
00000150  ae 00 00 00 17 00 00 00  00 00 00 00 00 00 00 00  |................|
00000160  01 00 00 00 00 00 00 00                           |........|
00000168

I've also seen https://docs.oracle.com/cd/E19455-01/806-3773/6jct9o0bs/index.html

as well as this https://linux-audit.com/elf-binaries-on-linux-understanding-and-analysis/

which gives this useful picture diagram: enter image description here

as well as a link to the elf header file.

The question:

How, exactly, can I simply "insert" the pure machine language list of commands directly into an ELF file format (perhaps using a template based on the above?) without using any external dependencies (like NASM, LD etc.), only a pure binary writer?

I tried simply changing the string "Hello, World!" to something longer, but (obviously) it got cut off, because the length was only set to a specific amount, but I don't know where to find the length attribute in the binary code, if someone could at least point to that, then that would be helpful

assembly
nasm
elf
machine-code
machine-language
asked on Stack Overflow Apr 29, 2020 by bluejayke • edited Apr 29, 2020 by bluejayke

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0