{"id":306,"date":"2021-10-24T14:49:17","date_gmt":"2021-10-24T06:49:17","guid":{"rendered":"http:\/\/pareto.fun\/?p=306"},"modified":"2021-12-01T14:20:28","modified_gmt":"2021-12-01T06:20:28","slug":"arm32-shellcode-%e7%94%9f%e6%88%90%e6%96%b9%e6%b3%95","status":"publish","type":"post","link":"http:\/\/pareto.fun\/?p=306","title":{"rendered":"arm32 shellcode \u751f\u6210\u65b9\u6cd5"},"content":{"rendered":"\n<p>\u8be5\u65b9\u6cd5\u4ec5\u4ee3\u8868\u4e2a\u4eba\u4f7f\u7528\u65b9\u6cd5\uff0c\u8981\u662f\u6709\u66f4\u597d\u7684\u65b9\u6cd5\uff0c\u6211\u5012\u662f\u60f3\u8bd5\u8bd5\u4f60\u7684\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why \uff1a<\/h2>\n\n\n\n<p>\u60f3\u8981\u5728elf\u6587\u4ef6\u6ce8\u5165shellcode\u5b8c\u6210\u5916\u90e8\u51fd\u6570\u7684\u8c03\u7528\u3002<\/p>\n\n\n\n<p>\u5916\u90e8\u7b26\u53f7\u8c03\u7528\uff0celf\u6709\u4e24\u79cd\u5904\u7406\u65b9\u5f0f\uff0c1. \u8c03\u7528dlopen \uff0cdlopen \u4e3b\u52a8\u8c03\u7528\u3002 2. \u5728\u751f\u6210elf\u6587\u4ef6\u65f6\uff0c\u5f15\u5165\u5916\u90e8\u7b26\u53f7\u3002<\/p>\n\n\n\n<p>\u90a3\u4e48shellcode\u8c03\u7528\u5916\u90e8\u7b26\u53f7\u4e5f\u53ef\u4ee5\u8d70\u8fd9\u4e24\u79cd\u65b9\u5f0f\u3002<\/p>\n\n\n\n<p>\u7b2c\u4e00\u79cd\u65b9\u6848\uff0c\u76f8\u5bf9\u7b80\u5355\u70b9\uff0c\u7edd\u5927\u591a\u6570\u7684so\u6587\u4ef6\u90fd\u4f1a\u5bfc\u5165dlopen\u548cdlsym\u7b26\u53f7\uff0c\u5c31\u53ea\u9700\u8981\u81ea\u5df1\u5b9e\u73b0\u8c03\u7528\u4e86\u3002<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How\uff1a<\/h2>\n\n\n\n<p>\u5229\u7528ndk\u91cc\u9762\u7684\u7f16\u8bd1\u5de5\u5177as \uff0c\u5c06\u5199\u597d\u7684asm \u8f6c\u5316\u4e3aelf\uff0c\u8fd9\u6837\u7684elf\u6587\u4ef6\u7ed3\u6784\u7b80\u5355\uff0c\u7075\u6d3b\uff0c\u5305\u542b\u4e86\u4ee3\u7801\u548c\u9700\u8981\u7684\u5b57\u7b26\u4e32\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.data \nstring: .asciz \"American\\n\"\n\n.text \n.global _start\n\n_start: \n\tadd  r12 , pc ,#0x8 @ \u83b7\u53d6\u5b57\u7b26\u4e32\n\tmov r0 , r12 \n\tblx dlsym\nendoftext:\n<\/code><\/pre>\n\n\n\n<p>as main.S -o main<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"658\" height=\"93\" src=\"http:\/\/pareto.fun\/wp-content\/uploads\/2021\/10\/image.png\" alt=\"\" class=\"wp-image-308\" srcset=\"http:\/\/pareto.fun\/wp-content\/uploads\/2021\/10\/image.png 658w, http:\/\/pareto.fun\/wp-content\/uploads\/2021\/10\/image-300x42.png 300w\" sizes=\"(max-width: 658px) 100vw, 658px\" \/><\/figure>\n\n\n\n<p>\u540c\u6837\u53ef\u4ee5\u7528android studio \u914d\u5408Cmakelist\u6765\u7f16\u8bd1asm\u6587\u4ef6\u66f4\u52a0\u65b9\u4fbf\u7f16\u5199\u548c\u8c03\u8bd5\u3002<\/p>\n\n\n\n<p>\u521b\u5efa\u6587\u4ef6<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"314\" height=\"240\" src=\"http:\/\/pareto.fun\/wp-content\/uploads\/2021\/10\/image-1.png\" alt=\"\" class=\"wp-image-309\" srcset=\"http:\/\/pareto.fun\/wp-content\/uploads\/2021\/10\/image-1.png 314w, http:\/\/pareto.fun\/wp-content\/uploads\/2021\/10\/image-1-300x229.png 300w\" sizes=\"(max-width: 314px) 100vw, 314px\" \/><\/figure>\n\n\n\n<p>cmake \u5141\u8bb8\u7f16\u8bd1asm<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"333\" height=\"52\" src=\"http:\/\/pareto.fun\/wp-content\/uploads\/2021\/10\/image-2.png\" alt=\"\" class=\"wp-image-310\" srcset=\"http:\/\/pareto.fun\/wp-content\/uploads\/2021\/10\/image-2.png 333w, http:\/\/pareto.fun\/wp-content\/uploads\/2021\/10\/image-2-300x47.png 300w\" sizes=\"(max-width: 333px) 100vw, 333px\" \/><\/figure>\n\n\n\n<p>\u6dfb\u52a0\u7f16\u8bd1\u6587\u4ef6<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"593\" height=\"260\" src=\"http:\/\/pareto.fun\/wp-content\/uploads\/2021\/10\/image-3.png\" alt=\"\" class=\"wp-image-311\" srcset=\"http:\/\/pareto.fun\/wp-content\/uploads\/2021\/10\/image-3.png 593w, http:\/\/pareto.fun\/wp-content\/uploads\/2021\/10\/image-3-300x132.png 300w\" sizes=\"(max-width: 593px) 100vw, 593px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>shell\u9075\u5faa\u7684\u539f\u5219\u5c06\u4ee3\u7801\u548c\u6570\u636e\u533a\u522b\u5f00\u3002<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>\u7ecf\u8fc7\u4e24\u5929\u7684\u4f18\u5316\uff0c\u5f97\u5230\u7684shellcode\u6a21\u677f\uff0c\u4fee\u540e\u4ec5\u9700\u4fee\u6539\u6570\u636e\u90e8\u5206\u5373\u53ef\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\n.text\n.global func\n.hidden func\n.type func , #function\n.align 4\n.fnstart\nfunc:\n    push {r0 , r1,  r2 , r3 , r4,r12 , lr} @ r0 \u53c2\u65700 \uff0c r1 \u53c2\u65701 \uff0cr2 \u8fd0\u7b97\u57fa\u5730\u5740\uff0cr3 got\u8868\u5730\u5740 \uff0cr12 \u76ee\u6807\u51fd\u6570\u5730\u5740\uff0c\n    mov r0 , #0xffffffff \n\tadd  r12 , pc , #0x28\n\tmov r1 , r12\t\n\tadd r12 , pc , #0 \n\tldr r3 , fileoffset  @\u51cf\u53bb\u6ce8\u5165\u5730\u5740\u504f\u79fb\n\tsub r12 , r3 \n\tsub r12 , #0x18 @ \u51cf\u53bbip\u504f\u79fb\uff0c\u83b7\u5f97\u57fa\u5740\n\tldr r3 , gotoffset\n\tadd r12 , r3 @ 0xff \u66ff\u6362\u4e3agot\u8868\u504f\u79fb\n    ldr r4 , &#91;r12]\n\tblx r4\n\tblx r0\n\tpop {r0 , r1, r2 , r3 , r4,r12 , pc}\nendoffunc:\n    string: .asciz \"jjno1\"\n    gotoffset: .int 0x86c2ae4 \n    fileoffset: .int 0x318\n.fnend\n.size func  , . - func\n\n<\/code><\/pre>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u8be5\u65b9\u6cd5\u4ec5\u4ee3\u8868\u4e2a\u4eba\u4f7f\u7528\u65b9\u6cd5\uff0c\u8981\u662f\u6709\u66f4\u597d\u7684\u65b9\u6cd5\uff0c\u6211\u5012\u662f\u60f3\u8bd5\u8bd5\u4f60\u7684\u3002 Why \uff1a \u60f3\u8981\u5728elf\u6587\u4ef6\u6ce8\u5165sh [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1,16],"tags":[22],"_links":{"self":[{"href":"http:\/\/pareto.fun\/index.php?rest_route=\/wp\/v2\/posts\/306"}],"collection":[{"href":"http:\/\/pareto.fun\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/pareto.fun\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/pareto.fun\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/pareto.fun\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=306"}],"version-history":[{"count":7,"href":"http:\/\/pareto.fun\/index.php?rest_route=\/wp\/v2\/posts\/306\/revisions"}],"predecessor-version":[{"id":319,"href":"http:\/\/pareto.fun\/index.php?rest_route=\/wp\/v2\/posts\/306\/revisions\/319"}],"wp:attachment":[{"href":"http:\/\/pareto.fun\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/pareto.fun\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=306"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/pareto.fun\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}