61 lines
1.3 KiB
ArmAsm
61 lines
1.3 KiB
ArmAsm
.intel_syntax noprefix
|
|
.globl main
|
|
|
|
.section .rodata
|
|
SHELLCODE: .ascii "\x31\xC0\xFF\xC0\x89\xC7\x48\x8D\x35\x08\x00\x00\x00\xBA\x0E\x00\x00\x00\x0F\x05\xC3Hello, World!\n"
|
|
SHELLCODE_end:
|
|
|
|
SHELLCODE_len = SHELLCODE_end - SHELLCODE
|
|
|
|
#define PROT_READ 0x1
|
|
#define PROT_WRITE 0x2
|
|
#define PROT_EXEC 0x4
|
|
|
|
#define MAP_PRIVATE 0x2
|
|
#define MAP_ANONYMOUS 0x20
|
|
|
|
#define MAP_FAILED -1
|
|
|
|
.section .text
|
|
main:
|
|
#define VAR1 [rsp]
|
|
sub rsp, 8
|
|
|
|
// rax = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0)
|
|
xor edi, edi
|
|
mov rsi, OFFSET SHELLCODE_len
|
|
mov edx, PROT_READ | PROT_WRITE
|
|
mov ecx, MAP_PRIVATE | MAP_ANONYMOUS
|
|
mov r8, -1
|
|
xor r9d, r9d
|
|
call QWORD PTR [mmap@GOTPCREL + rip]
|
|
mov VAR1, rax
|
|
|
|
cmp rax, MAP_FAILED
|
|
je .abort
|
|
|
|
// rax = mmove(VAR1, SHELLCODE, SHELLCODE_len)
|
|
mov rdi, rax
|
|
lea rsi, [rip+SHELLCODE]
|
|
mov rdx, OFFSET SHELLCODE_len
|
|
call QWORD PTR [memmove@GOTPCREL + rip]
|
|
|
|
// rax = mprotect(exec_mem, content.len(), PROT_READ | PROT_EXEC)
|
|
mov rdi, rax
|
|
mov rsi, OFFSET SHELLCODE_len
|
|
mov edx, PROT_READ | PROT_EXEC
|
|
call QWORD PTR [mprotect@GOTPCREL + rip]
|
|
|
|
test rax, rax
|
|
jnz .abort
|
|
|
|
mov rax, VAR1
|
|
call qword ptr VAR1
|
|
|
|
// exit(0)
|
|
xor edi, edi
|
|
call QWORD PTR [exit@GOTPCREL + rip]
|
|
|
|
.abort:
|
|
call QWORD PTR [abort@GOTPCREL + rip]
|