1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
|
; elf thing in assembly
; Written by: Test_User <hax@andrewyu.org>
;
; This is free and unencumbered software released into the public
; domain.
;
; Anyone is free to copy, modify, publish, use, compile, sell, or
; distribute this software, either in source code form or as a compiled
; binary, for any purpose, commercial or non-commercial, and by any
; means.
;
; In jurisdictions that recognize copyright laws, the author or authors
; of this software dedicate any and all copyright interest in the
; software to the public domain. We make this dedication for the benefit
; of the public at large and to the detriment of our heirs and
; successors. We intend this dedication to be an overt act of
; relinquishment in perpetuity of all present and future rights to this
; software under copyright law.
;
; THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
; EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
; MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
; IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
; OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
; ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
; OTHER DEALINGS IN THE SOFTWARE.
[bits 64]
[section elf_header start=0]
ELF_HEADER_START:
db 0x7F, "E", "L", "F" ; first 4 bytes
db 0x02 ; 64-bit
db 0x01 ; little-endian
db 0x01 ; version indicator, currently must be 1
db 0x00 ; generic unix thing
db 0x00 ; yes
times 16 - ($ - $$) db 0x00 ; padding
dw 0x0002 ; executable thing
dw 0x003E ; x86_64
dd 0x00000001 ; version again
dq entry ; starting address
dq PROGRAM_HEADER_START ; where the program header is in the file
dq 0x0000000000000000 ; no section header
dd 0x00000000 ; no flags
dw ELF_HEADER_SIZE ; needed
dw PROGRAM_HEADER_SIZE ; how large is each program header
dw 0x0001 ; number of program headers
dw 0x0000 ; no section size because no sections
dw 0x0000 ; no sections
dw 0x0000 ; no string header thing because no sections
ELF_HEADER_SIZE equ $ - ELF_HEADER_START
PROGRAM_HEADER_START:
dd 0x00000001 ; load this into memory
dd 0x00000007 ; read | execute | write, apparently possible
dq FILE_START ; offset in file
dq RAM_START ; offset in virtual address
dq 0x0000000000000000 ; physical location, doesn't really matter
dq EXECUTABLE_SECTION_SIZE ; size in file
dq EXECUTABLE_SECTION_RAM ; size in ram
dq 0x0000000000000000 ; no alignment required
PROGRAM_HEADER_SIZE equ $ - PROGRAM_HEADER_START
PROGRAM_HEADER_END:
FILE_START EQU $-$$
MAP_START EQU 0x400000
[section executable vstart=0x0000000000400000+FILE_START align=1]
CLONE_VM EQU 0x00000100
RAM_START:
other_thread:
mov rax, 0x3B
mov rdi, subprocess_file
xor rsi, rsi
xor rdx, rdx
syscall
; if exec fails for some reason...
mov BYTE [exec_fail], 1
exit:
mov rax, 0x3C
mov rdi, 0x01
syscall
entry:
unmap_junk:
; MAP_END: first byte outside of our mapping
; MAP_START: first byte inside out our mapping
xor rdi, rdi
mov rsi, MAP_START
mov rax, 0x0B
syscall
mov rdi, MAP_END
mov rsi, 0x7FFFFFFFF000 ; top of address space
sub rsi, rdi
mov rax, 0x0B
syscall
spawn:
mov rax, 0x38
mov rdi, CLONE_VM ; flags
; xor rsi, rsi ; stack pointer... who needs a stack anyways :D
syscall
test rax, rax
jz other_thread
.wait_loop:
mov rax, 0xF7
xor rdi, rdi ; P_ALL
; rsi ignored because P_ALL
xor rdx, rdx ; no infop
mov r10, 0x40000004 ; __WALL | WEXITED
syscall
cmp rax, -10 ; -ECHILD
jne .wait_loop
cmp BYTE [exec_fail], 0
je spawn ; if there was no *critical* failure, like executable missing or whatever
jmp exit
subprocess_file:
db "/bin/bash", 0
EXECUTABLE_SECTION_SIZE equ $ - RAM_START
[absolute 0x0000000000400000+FILE_START+EXECUTABLE_SECTION_SIZE]
UNINITIALIZED_START:
exec_fail:
resb 1
RAM_END:
EXECUTABLE_SECTION_RAM equ EXECUTABLE_SECTION_SIZE + $ - UNINITIALIZED_START
resb (0-($-$$)) % 4096
MAP_END:
|
