diff --git a/README.md b/README.md index 5c26424..132e384 100644 --- a/README.md +++ b/README.md @@ -4,4 +4,4 @@ PoC's showing how rust can do stuff people often critiquize it about. # Members -- `rust-teeny`: A rust std binary only **8.6 KiB** big, achieves so by `abort()`ing instead of having graceful error logging, panics shouldn't have any source information nor should there be `Debug` implementations, no debug symbols and any potential path reference to `$PWD` is renamed. It carries a shellcode payload loaded into memory and executed from memory. +- `rust-teeny`: A rust std binary only **8.0 KiB** big, achieves so by `abort()`ing instead of having graceful error logging, panics shouldn't have any source information nor should there be `Debug` implementations, no debug symbols and any potential path reference to `$PWD` is renamed. It carries a shellcode payload loaded into memory and executed from memory. diff --git a/rust-teeny/README.md b/rust-teeny/README.md index 021386d..c4f6cc2 100644 --- a/rust-teeny/README.md +++ b/rust-teeny/README.md @@ -1,4 +1,4 @@ -Tiny stripped rust binary (8.6 KiB, x86_64, dynamic libc) that loads and executes a shellcode payload built into it. +Tiny stripped rust binary (8.0 KiB, x86_64, dynamic libc) that loads and executes a shellcode payload built into it. ## Building @@ -13,3 +13,4 @@ The code is completely correct, checks `mmap` and `mprotect` succeeded, the code - Memory mapping a RWX page directly, some protected kernel builds require `RW` -> `RX` transition though. - Assuming mmap and mprotect succeeded, no modern kernel should fail on `mmap` even if out of memory, the mapping is done regardless and memory actually reserved once used. `mprotect` shouldn't fail either if done correctly (man page mentions failures because no memory, which I said shouldn't happen, invalid permission combinations and invalid, which don't happen if you do correct permissions and valid pointers, or rare permission cases). - `no_std`, this barely needs std, could just hardcode the 3-4 syscalls present and don't use `std` at all. This code also hardcoded `libc` values before so that's not needed either, but I think `libc` has `no_std` support either way. +- 0.1 KiB can be removed if you get rid of `.gnu.hash` and `.gnu.version` sections, but I think those can be required on other machines, not on mine though. diff --git a/rust-teeny/justfile b/rust-teeny/justfile index facd074..c26c900 100644 --- a/rust-teeny/justfile +++ b/rust-teeny/justfile @@ -11,7 +11,7 @@ build: -Zlocation-detail=none -Zfmt-debug=none \ \ -Clinker=clang -Clink-arg=-fuse-ld=lld \ - -Clink-arg=-Wl,--gc-sections -Clink-arg=-Wl,--strip-all \ + -Clink-arg=-Wl,--gc-sections -Clink-arg=-Wl,--as-needed -Clink-arg=-Wl,--strip-all -Clink-arg=-Wl,--build-id=none \ \ -Cpanic=immediate-abort --remap-path-prefix=$PWD=[src] \ " cargo \ @@ -21,6 +21,17 @@ build: \ b -r --target {{ target }} + # Base, does like nothing + strip --strip-all --strip-unneeded target/{{ target }}/release/rust-teeny + + # BS, I don't want these + strip -R .comment -R .note.\* target/{{ target }}/release/rust-teeny + + # Only OK because we don't do unwinding + strip -R .eh_frame\* target/{{ target }}/release/rust-teeny + + # Not sure why .gnu.version and .gnu.hash don't break if I remove them in my machine, but that's very relative and its related to dynamic loading, but they could reduce size by `0.2 KiB` + stat: stat target/{{ target }}/release/rust-teeny