From ebe7dd1682f79edae434b3440516f694b43bee79 Mon Sep 17 00:00:00 2001
From: jakob <jakob@memeware.net>
Date: Sun, 22 Oct 2017 15:01:36 -0400
Subject: Initial calling to internal _dl_open

---
 hypodermic/shellcode.py | 40 +++++++++++++---------------------------
 1 file changed, 13 insertions(+), 27 deletions(-)

(limited to 'hypodermic/shellcode.py')

diff --git a/hypodermic/shellcode.py b/hypodermic/shellcode.py
index 114a4bc..38aa841 100644
--- a/hypodermic/shellcode.py
+++ b/hypodermic/shellcode.py
@@ -164,12 +164,12 @@ def munmap_shellcode(addr=0, size=0, arch="amd64"):
     return assemble(asm, arch)
 
 
-# FIXME: Relative addressing is untested in i386.
-def dlopen_shellcode(addr: int, path: str, arch="amd64"):
+# TODO: i386 not implemented.
+def dlopen_shellcode(dlopen: int, ret: int, path: str, arch="amd64"):
     """Generates shellcode to invoke _dl_open in the RTLD.
 
     Args:
-        addr (int): The absolute address of _dl_open.
+        dlopen (int): The absolute address of _dl_open.
         path (str): The path of the library to open.
 
     Returns:
@@ -180,29 +180,15 @@ def dlopen_shellcode(addr: int, path: str, arch="amd64"):
               "__path:" \
               "        .asciz \"{}\";" \
               "__path_end:" \
-              "        leaq (%rip),      %rdi;" \
-              "        subq $. - __path, %rdi;" \
-              "        movq $0x80000101, %rsi;" \
-              "        movq $0x00,       %rdx;" \
-              "        movq $0x00,       %rcx;" \
-              "        movq $0x00,       %r8;" \
-              "        movq $0x00,       %r9;" \
-              "        pushq $0x00;" \
-              "        callq ${};".format(path, addr)
+              "        leaq (%rip),              %rdi;" \
+              "        subq $. - __path,         %rdi;" \
+              "        movq $0x80000101,         %rsi;" \
+              "        movq ${},                 %rdx;" \
+              "        movq $0xfffffffffffffffe, %rcx;" \
+              "        movq $0x00,               %r8;" \
+              "        movq $0x00,               %r9;" \
+              "        movq $0x00,               %r10;" \
+              "        callq ${};".format(path, ret, dlopen)
     else:
-        asm = "        jmp __path_end;" \
-              "__path:" \
-              "        .asciz \"{}\";" \
-              "__path_end:" \
-              "        call $. + 5;" \
-              "        popl %ebx;" \
-              "        subl $. - 4 - __path, %ebx;" \
-              "        pushl %ebx;" \
-              "        pushl $0x80000101;" \
-              "        pushl $0x00;" \
-              "        pushl $0x00;" \
-              "        pushl $0x00;" \
-              "        pushl $0x00;" \
-              "        pushl $0x00;" \
-              "        calll ${};".format(path, addr)
+        asm = ""
     return assemble(asm, arch)
-- 
cgit v1.3