# CSC 472 • Week 4 • September 15 and 17, 2026

Dr. Si Chen • West Chester University

These classroom demonstrations adapt ss2024 Chapter 6. Use your WolfCTF
Lab 1 terminal at https://portal.wolfctf.com/labs/lab1 (GDB + GEF included).
All commands below run inside the Linux terminal, not in macOS/Windows.
They create a separate ~/csc472-week04 directory and do not edit Lab 1 files.

## Get the files

```sh
cd ~
curl -fLO https://wcu.ninja/files/CSC472_Week04_code.tar.gz
tar -xzf CSC472_Week04_code.tar.gz
cd ~/csc472-week04
```

## Class 6: System calls (Tuesday, September 15)

```sh
cd ~/csc472-week04/class06
make
file helloworld
./helloworld
strace -e trace=write,exit ./helloworld > /dev/null
gdb -q ./helloworld
```

In GDB (GEF loads automatically):

```text
gef config context.layout 'regs code stack'
break write_call
run
info registers eax ebx ecx edx
x/13cb $ecx
si
print/d $eax
quit
```

Before int 0x80: EAX=4, EBX=1, ECX points to the message, EDX=13.
After stepping over the syscall, EAX=13 for this successful short write.
`si` observes the user-space result; it does not step through kernel code.
General programs must handle write errors and short writes.

`./shell` runs /bin/sh using execve; type `exit` to return to the lab terminal.
`execve` replaces the current process image; it does not create a new process.
The pathname and pointer arrays are in .data, so this ELF example is not
portable raw shellcode. Addresses in its object file need link-time relocation.

## Class 7: Shellcode (Thursday, September 17)

```sh
cd ~/csc472-week04/class07
make
objdump -d -M intel hello.o
readelf -r hello.o
od -An -tx1 hello.bin
wc -c hello.bin
./hello_runner
printf '\n'
gdb -q ./hello_runner
```

`hello.bin` is 37 bytes, prints exactly `hello` (5 bytes, no newline), and
calls exit(0). It contains no NUL bytes. The .text payload is self-contained
and position-independent; debug-section relocations in `hello.o` do not
make the extracted .text payload nonportable. Inspect the relocation section
names: there should be no `.rel.text` entries.

In GDB:

```text
gef config context.layout 'regs code stack'
break ready_for_debug
run
print/x region
set $p = (unsigned char *)region
x/37bx $p
x/12i $p
vmmap
break *$p
continue
si
si
x/wx $esp
x/5cb *(unsigned int *)$esp
```

The first `si` follows the jump; the second executes `call starter`.
The stack now holds the runtime address of the inline `hello` bytes.
Continue stepping through the XOR/MOV instructions and `pop ecx`;
check ECX and `x/5cb $ecx` before the write syscall.
Use the actual mapping address from this run. Your addresses may differ.

The runner copies to a writable mapping, then changes that mapping to RX.
It does not disable NX globally. The stack is not marked executable.
The old ss2024 Aleph One byte string modifies its inline data; running it
unchanged in this RX mapping would fault. `execve_stack.asm` instead builds
its pathname, argv, and envp on the writable stack.

Optional extension (same unprivileged account, local container):

```sh
./shell_runner
id
exit
```

## Practice (not a new graded submission)

1. Class 6: predict registers for write(1, msg, 5), change the byte count,
   rebuild, and compare the output and return value in GEF.
2. Class 7: change `hello` to `WCU!!` (still 5 bytes), rebuild, and explain why
   the extracted payload can be copied to a different address.
3. Explain why DB emits bytes, DD emits 32-bit values, and why argv contains
   pointers followed by a NULL pointer rather than characters alone.

Lab 1 remains due Thursday, September 24, 2026, 11:59 PM Eastern Time.
Submit one PDF in D2L → CSC 472 → Assignments → Lab 1.
Instructions: https://wcu.ninja/csc472/lab1
Report format and submission: https://wcu.ninja/csc472/lab-report

## References

Original: https://www.cs.wcupa.edu/SCHEN/ss2024/slides/ch06.pptx
Original code: https://www.cs.wcupa.edu/SCHEN/ss2024/
Linux ABI: https://man7.org/linux/man-pages/man2/syscall.2.html
execve: https://man7.org/linux/man-pages/man2/execve.2.html
mmap: https://man7.org/linux/man-pages/man2/mmap.2.html
mprotect: https://man7.org/linux/man-pages/man2/mprotect.2.html
NASM: https://www.nasm.us/doc/nasm09.html
objcopy: https://sourceware.org/binutils/docs/binutils/objcopy.html