I'm trying to call execve("/bin/cat", "filename" , NULL) via a chain of ROP gadget I'm able to step through the syscall but no output or error is shown so I'm not sure what is the problem
Using gdb, this is the last gadget in the ROP chain. I can only find call gs without ret, but i think it should be ok
(gdb) x/20i $pc
=> 0xf7dfb8ae: call *%gs:0x10
0xf7dfb8b5: pop %ebx
0xf7dfb8b6: ret
0xf7dfb8b7: lea
(gdb) info registers
eax 0xb 11
ecx 0xffffde1a -8678
edx 0xffffde19 -8679
ebx 0xffffde11 -8687
esp 0xffffde60 0xffffde60
ebp 0xffffde48 0xffffde48
esi 0xf7fbb000 -134500352
edi 0xf7fbb000 -134500352
eip 0xf7dfb8ae 0xf7dfb8ae
eflags 0x202 [ IF ]
cs 0x23 35
ss 0x2b 43
ds 0x2b 43
es 0x2b 43
fs 0x0 0
gs 0x63 99
(gdb) x/s $ebx
0xffffde11: "/bin/cat"
(gdb) x/s $ecx
0xffffde1a: "/home/victim/flag.txt"
(gdb) x/s $edx
0xffffde19: ""
Below are the arguments with null-terminated
(gdb) x /32x $ebx
0xffffde11: 0x2f 0x62 0x69 0x6e 0x2f 0x63 0x61 0x74
0xffffde19: 0x00 0x2f 0x68 0x6f 0x6d 0x65 0x2f 0x76
0xffffde21: 0x69 0x63 0x74 0x69 0x6d 0x2f 0x66 0x6c
0xffffde29: 0x61 0x67 0x2e 0x74 0x78 0x74 0x00 0x00
Thank you