diff options
Diffstat (limited to 'hypodermic/shellcode.py')
| -rw-r--r-- | hypodermic/shellcode.py | 40 |
1 files changed, 13 insertions, 27 deletions
diff --git a/hypodermic/shellcode.py b/hypodermic/shellcode.py index 114a4bc..38aa841 100644 --- a/hypodermic/shellcode.py +++ b/hypodermic/shellcode.py @@ -164,12 +164,12 @@ def munmap_shellcode(addr=0, size=0, arch="amd64"): return assemble(asm, arch) -# FIXME: Relative addressing is untested in i386. -def dlopen_shellcode(addr: int, path: str, arch="amd64"): +# TODO: i386 not implemented. +def dlopen_shellcode(dlopen: int, ret: int, path: str, arch="amd64"): """Generates shellcode to invoke _dl_open in the RTLD. Args: - addr (int): The absolute address of _dl_open. + dlopen (int): The absolute address of _dl_open. path (str): The path of the library to open. Returns: @@ -180,29 +180,15 @@ def dlopen_shellcode(addr: int, path: str, arch="amd64"): "__path:" \ " .asciz \"{}\";" \ "__path_end:" \ - " leaq (%rip), %rdi;" \ - " subq $. - __path, %rdi;" \ - " movq $0x80000101, %rsi;" \ - " movq $0x00, %rdx;" \ - " movq $0x00, %rcx;" \ - " movq $0x00, %r8;" \ - " movq $0x00, %r9;" \ - " pushq $0x00;" \ - " callq ${};".format(path, addr) + " leaq (%rip), %rdi;" \ + " subq $. - __path, %rdi;" \ + " movq $0x80000101, %rsi;" \ + " movq ${}, %rdx;" \ + " movq $0xfffffffffffffffe, %rcx;" \ + " movq $0x00, %r8;" \ + " movq $0x00, %r9;" \ + " movq $0x00, %r10;" \ + " callq ${};".format(path, ret, dlopen) else: - asm = " jmp __path_end;" \ - "__path:" \ - " .asciz \"{}\";" \ - "__path_end:" \ - " call $. + 5;" \ - " popl %ebx;" \ - " subl $. - 4 - __path, %ebx;" \ - " pushl %ebx;" \ - " pushl $0x80000101;" \ - " pushl $0x00;" \ - " pushl $0x00;" \ - " pushl $0x00;" \ - " pushl $0x00;" \ - " pushl $0x00;" \ - " calll ${};".format(path, addr) + asm = "" return assemble(asm, arch) |