initial commit

rust-teeny/README.md

@@ -0,0 +1,15 @@
+Tiny stripped rust binary (8.6 KiB, x86_64, dynamic libc) that loads and executes a shellcode payload built into it.
+
+## Building
+
+Just `just build`. Mostly uses CLI flags, but most could be moved into the `Cargo.toml`, needs a nightly compiler as of rust 1.96.0, the `rust-toolchain.toml` should take care of that though.
+
+It assumes building for `x86_64-unknown-linux-gnu` as I cannot manage to get a musl build and I don't know other architectures which need manual shellcode addition. But this can be extended to other architectures.
+
+## Properties
+
+The code is completely correct, checks `mmap` and `mprotect` succeeded, the code could theoretically be smaller but less correct by:
+
+- Memory mapping a RWX page directly, some protected kernel builds require `RW` -> `RX` transition though.
+- Assuming mmap and mprotect succeeded, no modern kernel should fail on `mmap` even if out of memory, the mapping is done regardless and memory actually reserved once used. `mprotect` shouldn't fail either if done correctly (man page mentions failures because no memory, which I said shouldn't happen, invalid permission combinations and invalid, which don't happen if you do correct permissions and valid pointers, or rare permission cases).
+- `no_std`, this barely needs std, could just hardcode the 3-4 syscalls present and don't use `std` at all. This code also hardcoded `libc` values before so that's not needed either, but I think `libc` has `no_std` support either way.