rust-teeny-nostd: 4 KiB

rust-teeny/src/main.rs

@@ -1,13 +1,33 @@
-use libc::{MAP_ANONYMOUS, MAP_PRIVATE, PROT_EXEC, PROT_READ, PROT_WRITE};
+#![no_std]
+#![no_main]
+use core::ffi::{c_int, c_void};
+
+use libc::{MAP_ANONYMOUS, MAP_PRIVATE, PROT_EXEC, PROT_READ, PROT_WRITE, off_t, size_t};
 
 // SAFETY: Shellcodes should have FFI behavior equivalent to an `unsafe extern "C" fn() -> ()`
 #[cfg(target_arch = "x86_64")]
 static SHELLCODE: &[u8] = b"\x31\xC0\xFF\xC0\x89\xC7\x48\x8D\x35\x08\x00\x00\x00\xBA\x0E\x00\x00\x00\x0F\x05\xC3Hello, World!\n";
 
+#[link(name = "c")]
+unsafe extern "C" {
+    fn mmap(
+        addr: *mut c_void,
+        len: size_t,
+        prot: c_int,
+        flags: c_int,
+        fd: c_int,
+        offset: off_t,
+    ) -> *mut c_void;
+
+    fn mprotect(addr: *mut c_void, len: size_t, prot: c_int) -> c_int;
+
+    fn exit(status: c_int) -> !;
+}
+
 /// Leaks memory
 fn alloc_shellcode(content: &[u8]) -> unsafe extern "C" fn() -> () {
     let exec_mem = unsafe {
-        libc::mmap(
+        mmap(
             core::ptr::null_mut(),
             content.len(),
             PROT_READ | PROT_WRITE,
@@ -21,13 +41,16 @@ fn alloc_shellcode(content: &[u8]) -> unsafe extern "C" fn() -> () {
 
     unsafe { core::ptr::copy_nonoverlapping(content.as_ptr(), exec_mem.cast(), content.len()) };
 
-    let mprotect_status = unsafe { libc::mprotect(exec_mem, content.len(), PROT_READ | PROT_EXEC) };
+    let mprotect_status = unsafe { mprotect(exec_mem, content.len(), PROT_READ | PROT_EXEC) };
     assert_eq!(mprotect_status, 0, "Mprotect failed");
 
     unsafe { core::mem::transmute(exec_mem) }
 }
 
+#[unsafe(no_mangle)]
 fn main() {
     let exec_mem = alloc_shellcode(SHELLCODE);
     unsafe { exec_mem() };
+
+    unsafe { exit(0) }
 }