Commit ab87914e authored by Chu's avatar Chu

update shellcode

parent 2c319d16
......@@ -132,17 +132,16 @@ void Process::set_registers(const user_regs_struct &registers)
void Process::call_func(const void *address, std::array<const void *, 6> args)
{
check_for_attached();
// 0: 48 bb ef be ad de ef be ad de movabs $0xdeadbeefdeadbeef, %rbx
// a: 48 83 ec 08 sub $0x8,%rsp
// e: ff d3 callq *%rbx
// 10: 48 83 c4 08 add $0x8,%rsp
// 14: cc int3
// 0: 48 83 e4 f0 and $0xfffffffffffffff0, %rsp
// 4: 48 bb ef be ad de ef be ad de movabs $0xdeadbeefdeadbeef, %rbx
// e: ff d3 callq *%rbx
// 10: cc int3
// https://stackoverflow.com/questions/44613592/shared-library-injection-dl-relocate-object-segfaults
std::vector<unsigned char> shellcode = {0x48, 0xbb, 0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde, 0x48,
0x83, 0xec, 0x08, 0xff, 0xd3, 0x48, 0x83, 0xc4, 0x08, 0xcc};
std::vector<unsigned char> shellcode = {0x48, 0x83, 0xe4, 0xf0, 0x48, 0xbb, 0xef, 0xbe, 0xad,
0xde, 0xef, 0xbe, 0xad, 0xde, 0xff, 0xd3, 0xcc};
while (shellcode.size() % sizeof(void *) != 0)
shellcode.emplace_back(0x90);
std::memcpy(shellcode.data() + 2, &address, sizeof(address));
std::memcpy(shellcode.data() + 6, &address, sizeof(address));
auto rx_area = find_rx_area();
auto original_code = read(rx_area, shellcode.size());
write(rx_area, shellcode);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment