HTB练习中Shellcode解码后无返回结果，求问题排查

我正在进行HTB练习，要求通过GDB分析文件，解码栈上加载的XOR加密Shellcode并运行以获取flag。目标文件会将加密Shellcode加载到栈中，将XOR解密密钥存储在rbx寄存器。我编写了对应的汇编代码进行解密，解密后得到了Shellcode，但执行后无任何返回结果，无法获取flag。以下是相关文件内容，求找出问题所在：

目标文件objdump结果 #

loaded_shellcode:     file format elf64-x86-64


Disassembly of section .text:

0000000000401000 <_start>:
  401000:   48 b8 d7 4b de 7c 5c    movabs rax,0xa284ee5c7cde4bd7
  401007:   ee 84 a2 
  40100a:   50                      push   rax
  40100b:   48 b8 9a 84 10 05 11    movabs rax,0x935add110510849a
  401012:   dd 5a 93 
  401015:   50                      push   rax
  401016:   48 b8 00 75 69 ab 9d    movabs rax,0x10b29a9dab697500
  40101d:   9a b2 10 
  401020:   50                      push   rax
  401021:   48 b8 9a 45 96 0d eb    movabs rax,0x200ce3eb0d96459a
  401028:   e3 0c 20 
  40102b:   50                      push   rax
  40102c:   48 b8 62 84 10 05 e3    movabs rax,0xe64c30e305108462
  401033:   30 4c e6 
  401036:   50                      push   rax
  401037:   48 b8 51 0c 3e 7c 5c    movabs rax,0x69cd355c7c3e0c51
  40103e:   35 cd 69 
  401041:   50                      push   rax
  401042:   48 b8 d6 85 a1 84 25    movabs rax,0x65659a2584a185d6
  401049:   9a 65 65 
  40104c:   50                      push   rax
  40104d:   48 b8 00 50 6c 6c 50    movabs rax,0x69ff00506c6c5000
  401054:   00 ff 69 
  401057:   50                      push   rax
  401058:   48 b8 81 56 50 aa 34    movabs rax,0x3127e434aa505681
  40105f:   e4 27 31 
  401062:   50                      push   rax
  401063:   48 b8 48 ff 69 1e 57    movabs rax,0x6af2a5571e69ff48
  40106a:   a5 f2 6a 
  40106d:   50                      push   rax
  40106e:   48 b8 e6 09 07 f2 af    movabs rax,0x6d179aaff20709e6
  401075:   9a 17 6d 
  401078:   50                      push   rax
  401079:   48 b8 c9 f1 5b 31 52    movabs rax,0x9ae3f152315bf1c9
  401080:   f1 e3 9a 
  401083:   50                      push   rax
  401084:   48 b8 9a 17 00 09 bb    movabs rax,0x373ab4bb0900179a
  40108b:   b4 3a 37 
  40108e:   50                      push   rax
  40108f:   48 b8 a3 a2 9a 05 44    movabs rax,0x69751244059aa2a3
  401096:   12 75 69 
  401099:   50                      push   rax
  40109a:   48 bb d2 44 21 4d 14    movabs rbx,0x2144d2144d2144d2
  4010a1:   d2 44 21

我的汇编代码 #

global _start
section .text
_start:
mov rax,0xa284ee5c7cde4bd7
push rax
mov rax,0x935add110510849a
push rax
mov rax,0x10b29a9dab697500
push rax
mov rax,0x200ce3eb0d96459a
push rax
mov rax,0xe64c30e305108462
push rax
mov rax,0x69cd355c7c3e0c51
push rax
mov rax,0x65659a2584a185d6
push rax
mov rax,0x69ff00506c6c5000
push rax
mov rax,0x3127e434aa505681
push rax
mov rax,0x6af2a5571e69ff48
push rax
mov rax,0x6d179aaff20709e6
push rax
mov rax,0x9ae3f152315bf1c9
push rax
mov rax,0x373ab4bb0900179a
push rax
mov rax,0x69751244059aa2a3
push rax
mov rbx,0x2144d2144d2144d2

mov rdx, rsp
add rcx, 14
sub rsp, 8
call decrypt

decrypt:
    xor [rdx], rbx
    add rdx, 8
    loop decrypt

解密得到的Shellcode #

69751244059aa2a3373ab4bb0900179a9ae3f152315bf1c96d179aaff20709e66af2a5571e69ff483127e434aa50568169ff00506c6c500065659a2584a185d669cd355c7c3e0c51e64c30e305108462200ce3eb0d96459a10b29a9dab697500935add110510849aa284ee5c7cde4bd7

问题分析与修正方案 #

1. RCX寄存器未初始化
   loop指令依赖RCX作为循环计数器，你的代码中add rcx,14是在RCX初始值未知的情况下操作，会导致循环次数完全随机，解密要么不完整要么过度解密。应改为mov rcx,14直接初始化计数器（对应14次push操作）。

2. Shellcode字节序错误
   x86-64是小端字节序，push操作会将rax的8字节按小端顺序存入栈中；同时栈是后进先出结构，最后push的内容位于栈顶，是Shellcode的起始位置。你直接按push顺序拼接大端十六进制值，导致字节序和顺序完全错误。正确的做法是：将每个push的rax值拆分为小端字节（比如0x69751244059aa2a3拆为a3 a2 9a 05 44 12 75 69），再按push的逆序拼接这些字节串。

3. 未执行解密后的Shellcode
   你的代码解密完成后没有跳转到栈上的Shellcode执行，程序会因后续无有效指令崩溃。需在解密结束后添加jmp rsp指令，直接跳转到栈顶执行Shellcode。

4. 不必要的栈操作
   sub rsp,8会破坏栈对齐，且对解密无帮助，应删除该指令。

修正后的汇编代码示例 #

global _start
section .text
_start:
mov rax,0xa284ee5c7cde4bd7
push rax
mov rax,0x935add110510849a
push rax
mov rax,0x10b29a9dab697500
push rax
mov rax,0x200ce3eb0d96459a
push rax
mov rax,0xe64c30e305108462
push rax
mov rax,0x69cd355c7c3e0c51
push rax
mov rax,0x65659a2584a185d6
push rax
mov rax,0x69ff00506c6c5000
push rax
mov rax,0x3127e434aa505681
push rax
mov rax,0x6af2a5571e69ff48
push rax
mov rax,0x6d179aaff20709e6
push rax
mov rax,0x9ae3f152315bf1c9
push rax
mov rax,0x373ab4bb0900179a
push rax
mov rax,0x69751244059aa2a3
push rax
mov rbx,0x2144d2144d2144d2

mov rdx, rsp
mov rcx, 14  ; 初始化循环计数器
decrypt:
    xor [rdx], rbx
    add rdx, 8
    loop decrypt

jmp rsp  ; 跳转到解密后的Shellcode执行

内容的提问来源于stack exchange，提问作者Niux