#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>
#include <sys/mman.h>
typedef void* (*dlopen_t)(const char* path, int mode);
typedef void* (*dlsym_t)(void* handle, const char* symbol);
typedefint (*puts_t)(constchar *);
void _dump_memory(const void *src, size_t len) {
char *start = (char*)src;
char *end = (char*)src + len;
if (len == 0) {
return;
}
char *fp = NULL;
do {
printf("%p: ", start);
fp = start;
for (int i = 0; i < 16; i++) {
if (fp < end) {
printf("%.2hhx ", *fp);
}else{
printf(" ");
}
fp ++;
}
fp = start;
printf("|");
for (int i = 0; i < 16; i ++) {
if (fp < end) {
if (*fp < 0x20 || *fp > 0x7e) {
printf(".");
}else{
printf("%c", *fp);
}
}else{
printf(" ");
}
fp ++;
}
start = fp;
printf("\n");
}while(fp < end);
printf("\n");
}
#define SHELLCODE_BEGIN(c) \
volatile int__HOLD_DATA = 0; \
goto START; \
NO_SKIP: \
__asm__ __volatile__(".asciz \"aa#$\"\n" c); \
goto __end; \
START:
#define SHELLCODE_END() if (__HOLD_DATA) goto NO_SKIP;__end:
#define FIND_STRINGS(...) \
{ \
char **sp[] = {__VA_ARGS__}; \
char *strings = (char*)shellcode; \
while (! (*strings == '#' && *(strings+1) == '$')) strings ++; \
strings += 2; \
\
for (int i = 0; i < sizeof(sp)/sizeof(void*); i++) { \
while (*strings == 0) strings++; \
*sp[i] = strings; \
while (*strings != 0) strings++; \
} \
}
typedef void (*shellcode_t)(dlopen_t dlopen_, dlsym_t dlsym_);
__attribute__ ((noinline)) void shellcode(dlopen_t dlopen_, dlsym_t dlsym_) {
SHELLCODE_BEGIN(
".asciz \"Hello ShellCodeFramework!\"\n"
".asciz \"puts\"\n"
".asciz \"libSystem.dylib\"\n"
);
char *s_hello;
char *s_puts;
char *s_libsystem;
FIND_STRINGS(
&s_hello,
&s_puts,
&s_libsystem);
puts_t puts_ = dlsym_(dlopen_(0, 0), s_puts);
puts_(s_hello);
SHELLCODE_END();
}
constchar *shellcode_example = "\x55\x48\x89\xe5\x53\x48\x83\xec\x38\x48\x89\xf3\x48\x89\xf8\xc7\x45\xf4\x00\x00\x00\x00\x48\x8d\x4d\xd8\x48\x89\x4d\xc0\x48\x8d\x4d\xe0\x48\x89\x4d\xc8\x48\x8d\x4d\xe8\x48\x89\x4d\xd0\x48\x8d\x0d\xcd\xff\xff\xff\xeb\x03\x48\xff\xc1\x80\x79\xfe\x23\x75\xf7\x80\x79\xff\x24\x75\xf1\x31\xd2\x48\xff\xc9\x48\x89\xce\x48\x89\xf1\x48\x8d\x71\x01\x80\x79\x01\x00\x74\xf3\x48\x8b\x7c\xd5\xc0\x48\x89\x37\x80\x79\x01\x00\x48\x8d\x49\x01\x75\xf6\x48\xff\xc2\x48\x83\xfa\x03\x75\xd2\x48\x8b\x7d\xe8\x31\xf6\xff\xd0\x48\x8b\x75\xe0\x48\x89\xc7\xff\xd3\x48\x8b\x7d\xd8\xff\xd0\x83\x7d\xf4\x00\x74\x32\x23\x24\x00\x48\x65\x6c\x6c\x6f\x20\x53\x68\x65\x6c\x6c\x43\x6f\x64\x65\x46\x72\x61\x6d\x65\x77\x6f\x72\x6b\x21\x00\x70\x75\x74\x73\x00\x6c\x69\x62\x53\x79\x73\x74\x65\x6d\x2e\x64\x79\x6c\x69\x62\x00\x48\x83\xc4\x38\x5b\x5d\xc3";
int main(int argc, char *argv[]) {
shellcode(dlopen, dlsym);
_dump_memory(shellcode, 204);
void *mem = mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
memcpy(mem, shellcode_example, 204);
if(mprotect(mem, 4096, PROT_EXEC|PROT_READ)){
printf("mprotect failed\n");
return -1;
}
((shellcode_t)mem)(dlopen, dlsym);
}
