arm shellcode 编写详析1

在编写arm shell code 之前，先介绍下arm中r0-r15寄存器的主要用途：

Register    Alt. Name       Usage
r0          a1              First function argument Integer function result Scratch register
r1          a2              Second function argument Scratch register
r2          a3              Third function argument Scratch register
r3          a4              Fourth function argument Scratch register

r4          v1              Register variable
r5          v2              Register variable
r6          v3              Register variable
r7          v4              Register variable
r8          v5              Register variable
r9          v6
rfp                         Register variable Real frame pointer

r10         sl              Stack limit
r11         fp              Argument pointer
r12         ip              Temporary workspace
r13         sp              Stack pointer
r14         lr              Link register Workspace
r15         pc              Program counte

r0-r3 一般用于传递函数参数，从左到右分别为参数1-参数4。r4-r9一般作为临时变量。在另一方面r7用来存储syscall的地址r13指向栈顶， r15指向下一条执行指令的地址。如果我们想要编写shellcode功能函数的话，我们需要先查找 syscall的地址，譬如_write和_exit函数，我们可以查找NDK里面的文件\android-ndk-r10e\platforms\android-19\arch-arm\usr\include\asm\unistd.h里面有：

#define __NR_write                  (__NR_SYSCALL_BASE+  4)
#define __NR_writev                 (__NR_SYSCALL_BASE+146)
#define __NR_pwrite64               (__NR_SYSCALL_BASE+181)
#define __NR_pciconfig_write        (__NR_SYSCALL_BASE+273)

#define __NR_exit                   (__NR_SYSCALL_BASE+  1)
#define __NR_exit_group             (__NR_SYSCALL_BASE+248)

然后我们可以建立maintest.s文件里面简单的用上_write和_exit

.section .text
.global _start

_start:

    # _write()
    mov     r2, #16      //size
    adr     r1, ascii    //void* buf
    mov     r0, #0x1     //fd
    mov     r7, #0x4     //syscall addr
    svc     0

    # _exit()
    sub r0, r0, r0
    mov     r7, $0x1
    svc 0

ascii:

    .string "hello shell\n"
    .balign 4

在当前目录建立一个编译的批处理命令：

E:\andorid\android-ndk-r10e\toolchains\arm-linux-androideabi-4.8\prebuilt\windows-x86_64\arm-linux-androideabi\bin\as.exe -o .\maintest.o .\maintest.s
E:\andorid\android-ndk-r10e\toolchains\arm-linux-androideabi-4.8\prebuilt\windows-x86_64\arm-linux-androideabi\bin\ld.exe -o .\maintest .\maintest.o
adb push E:\task\dirtycow\androidtest\maintest /data/local/tmp/
adb shell "chmod 777 /data/local/tmp/maintest"
pause 

运行结果：

E:\task\dirtycow\androidtest>E:\andorid\android-ndk-r10e\toolchains\arm-linux-an
droideabi-4.8\prebuilt\windows-x86_64\arm-linux-androideabi\bin\as.exe -o .\main
test.o .\maintest.s
.\maintest.s: Assembler messages:
.\maintest.s: Warning: end of file not at end of a line; newline inserted

E:\task\dirtycow\androidtest>E:\andorid\android-ndk-r10e\toolchains\arm-linux-an
droideabi-4.8\prebuilt\windows-x86_64\arm-linux-androideabi\bin\ld.exe -o .\main
test .\maintest.o

E:\task\dirtycow\androidtest>adb push E:\task\dirtycow\androidtest\maintest /dat
a/local/tmp/
[100%] /data/local/tmp/maintest

E:\task\dirtycow\androidtest>adb shell "chmod 777 /data/local/tmp/maintest"

E:\task\dirtycow\androidtest>pause
请按任意键继续. . .

C:\Users\Administrator>adb shell
shell@pisces:/ $ /data/local/tmp/maintest
hello shell


shell@pisces:/ $