forked from ReversingID/Shellcode-Loader
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathcode.asm
More file actions
72 lines (61 loc) · 1.65 KB
/
Copy pathcode.asm
File metadata and controls
72 lines (61 loc) · 1.65 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
; Shellcode Loader
; Archive of Reversing.ID
;
;
; Compile:
; $ nasm -f elf64 code.asm -o code.o
; $ ld code.o -o code
; Run:
; $ ./code
%define SYS_MMAP 9
%define SYS_MPROTECT 10
%define SYS_MUNMAP 11
%define SYS_EXIT 60
%define PROT_READ 1
%define PROT_WRITE 2
%define PROT_EXEC 4
%define MAP_PRIVATE 2
%define MAP_ANONYMOUS 32
section .data
payload db 0x90, 0x90, 0xCC, 0xC3
payload_len equ $ - payload
section .text
global _start
_start:
; mmap(NULL, payload_len, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
xor rdi, rdi ; addr = NULL
mov rsi, payload_len ; length
mov rdx, PROT_READ | PROT_WRITE
mov r10, MAP_PRIVATE | MAP_ANONYMOUS
mov r8, -1 ; fd
xor r9, r9 ; offset
mov rax, SYS_MMAP
syscall
mov r12, rax ; save address to r12
; memcpy(runtime, payload, payload_len)
mov rdi, r12 ; dest = mmap'd addr
lea rsi, [rel payload] ; src
mov rcx, payload_len
.copy_loop:
mov al, [rsi]
mov [rdi], al
inc rsi
inc rdi
loop .copy_loop
; mprotect(runtime, payload_len, PROT_READ | PROT_EXEC)
mov rdi, r12
mov rsi, payload_len
mov rdx, PROT_READ | PROT_EXEC
mov rax, SYS_MPROTECT
syscall
; call the shellcode
call r12
; munmap(runtime, payload_len)
mov rdi, r12
mov rsi, payload_len
mov rax, SYS_MUNMAP
syscall
; exit(0)
xor rdi, rdi
mov rax, SYS_EXIT
syscall