rust-teeny-nostd: 4 KiB

rust-teeny-nostd/src/main.rs

@@ -0,0 +1,56 @@
+#![no_std]
+#![no_main]
+use core::ffi::{c_int, c_void};
+
+use libc::{MAP_ANONYMOUS, MAP_PRIVATE, PROT_EXEC, PROT_READ, PROT_WRITE, off_t, size_t};
+
+// SAFETY: Shellcodes should have FFI behavior equivalent to an `unsafe extern "C" fn() -> ()`
+#[cfg(target_arch = "x86_64")]
+static SHELLCODE: &[u8] = b"\x31\xC0\xFF\xC0\x89\xC7\x48\x8D\x35\x08\x00\x00\x00\xBA\x0E\x00\x00\x00\x0F\x05\xC3Hello, World!\n";
+
+#[link(name = "c")]
+unsafe extern "C" {
+    fn mmap(
+        addr: *mut c_void,
+        len: size_t,
+        prot: c_int,
+        flags: c_int,
+        fd: c_int,
+        offset: off_t,
+    ) -> *mut c_void;
+
+    fn mprotect(addr: *mut c_void, len: size_t, prot: c_int) -> c_int;
+
+    fn exit(status: c_int) -> !;
+}
+
+/// Leaks memory
+fn alloc_shellcode(content: &[u8]) -> unsafe extern "C" fn() -> () {
+    let exec_mem = unsafe {
+        mmap(
+            core::ptr::null_mut(),
+            content.len(),
+            PROT_READ | PROT_WRITE,
+            MAP_PRIVATE | MAP_ANONYMOUS,
+            -1,
+            0,
+        )
+    };
+
+    assert_ne!(exec_mem, libc::MAP_FAILED, "Map failed");
+
+    unsafe { core::ptr::copy_nonoverlapping(content.as_ptr(), exec_mem.cast(), content.len()) };
+
+    let mprotect_status = unsafe { mprotect(exec_mem, content.len(), PROT_READ | PROT_EXEC) };
+    assert_eq!(mprotect_status, 0, "Mprotect failed");
+
+    unsafe { core::mem::transmute(exec_mem) }
+}
+
+#[unsafe(no_mangle)]
+fn main() {
+    let exec_mem = alloc_shellcode(SHELLCODE);
+    unsafe { exec_mem() };
+
+    unsafe { exit(0) }
+}