initial commit

rust-teeny/src/main.rs

@@ -0,0 +1,33 @@
+use libc::{MAP_ANONYMOUS, MAP_PRIVATE, PROT_EXEC, PROT_READ, PROT_WRITE};
+
+// SAFETY: Shellcodes should have FFI behavior equivalent to an `unsafe extern "C" fn() -> ()`
+#[cfg(target_arch = "x86_64")]
+static SHELLCODE: &[u8] = b"\x31\xC0\xFF\xC0\x89\xC7\x48\x8D\x35\x08\x00\x00\x00\xBA\x0E\x00\x00\x00\x0F\x05\xC3Hello, World!\n";
+
+/// Leaks memory
+fn alloc_shellcode(content: &[u8]) -> unsafe extern "C" fn() -> () {
+    let exec_mem = unsafe {
+        libc::mmap(
+            core::ptr::null_mut(),
+            content.len(),
+            PROT_READ | PROT_WRITE,
+            MAP_PRIVATE | MAP_ANONYMOUS,
+            -1,
+            0,
+        )
+    };
+
+    assert_ne!(exec_mem, libc::MAP_FAILED, "Map failed");
+
+    unsafe { core::ptr::copy_nonoverlapping(content.as_ptr(), exec_mem.cast(), content.len()) };
+
+    let mprotect_status = unsafe { libc::mprotect(exec_mem, content.len(), PROT_READ | PROT_EXEC) };
+    assert_eq!(mprotect_status, 0, "Mprotect failed");
+
+    unsafe { core::mem::transmute(exec_mem) }
+}
+
+fn main() {
+    let exec_mem = alloc_shellcode(SHELLCODE);
+    unsafe { exec_mem() };
+}