flat assembler
Message board for the users of flat assembler.

Index > Linux > Can a '.text' section of an ELF binary be 'rwx'?

Author
Thread Post new topic Reply to topic
Jessé



Joined: 03 May 2025
Posts: 110
Location: Brazil
Jessé 13 Jun 2026, 06:00
Hello,

I did some trials with 'elf64.inc' original file from fasm2 headers, to figure out what appears to be the main reason it does not even try to set 'writeable executable' flags under a section: trying to do this under a '.text' section, which will be the main executable section of your dynamic address ELF, simply doesn't work, apparently. I tried many things, but the resulting executable was always 'r-x' flags for the '.text' section.
Has anyone tried something else to achieve a 'rwx' '.text' section?
My workaround is as follows, but it is done at runtime, not compile time, so the section starts as compiled with 'r-x' flags set:

Code:
; Self modifying code section example: it kind of replaces the missing '_code rwx' functionality,
; apparently unavailable to dynamic ELF '.text' section.
; After succeeded mprotect() call, this '.text' section behaves the same as '_code rwx'.

format ELF64

include 'fastcall.inc'
include 'stdmacros.inc'
include 'stdio.inc'

_code   Start entry:        lea         rdi, [$]
                            mov         r10, 0_FFFF_FFFF_FFFF_F000h
                            and         rdi, r10
                            mprotect(rdi, 4096, (PROT_READ or PROT_WRITE or PROT_EXEC));
                            test        eax, eax
                            jz          @f
                            fprintf(*stderr, &errfmt, "failed: ");
                            perror(NULL);
                            exit(1);

                    @@      fprintf(*stderr, &errfmt, "succeeded!"\n);

                            signal(SIGINT, &.break);

                    @@      inc         [count]

                            usleep(500'000);
                            test        [flags], 1
                            jnz         .end

                            fprintf(*stdout, <13,"Code section counter value: %lu",0>, *count);
                            fflush(*stdout);
                            jmp         @b

            .end:           fprintf(*stdout, "%s"\n "Finished."\n, <8,8,"  ",0>);
                            exit(0);

            .break:         or          [flags], 1
                            ret

        errfmt              xb 'Change memory protection %s', 0

        count               xq 0
        flags               xb 1111_1110b

; To compile:
;
; > ./build.sh code.rwx-dyn
;
; And then, run it:
;
; > ./code.rwx-dyn
;
; A good (and tested) way to see the change, is to look using edb-debugger under 'View->Memory Regions'
; before and after that mprotect() call, looking at the page address of that 'Start' entry point.
    


To ease understanding, that whole '_code' line macro from this example translates to:

Code:
section '.text' executable align 16
public Start
Start: lea rdi, [$]
    


Thanks in advance if anyone can help, so I can apply an improvement (not too useful, but an improvement anyways) on this beauty.

Cool

_________________
jesse6
Post 13 Jun 2026, 06:00
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20995
Location: In your JS exploiting you and your system
revolution 13 Jun 2026, 09:33
I had no trouble to get rwx
Code:
~ cat test.asm 
format elf64
section '' executable writeable
syscall    
Code:
~ fasm test.asm 
flat assembler  version 1.73.31  (16384 kilobytes memory)
1 passes, 400 bytes.    
Code:
~ objdump test -x

test:     file format elf64-x86-64
test
architecture: i386:x86-64, flags 0x00000102:
EXEC_P, D_PAGED
start address 0x0000000000400078

Program Header:
    LOAD off    0x0000000000000000 vaddr 0x0000000000400000 paddr 0x0000000000400000 align 2**12
         filesz 0x0000000000000188 memsz 0x0000000000000188 flags rwx

Sections:
Idx Name          Size      VMA               LMA               File off  Algn
SYMBOL TABLE:
no symbols    
Post 13 Jun 2026, 09:33
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2026, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.