Mastering Malware Analysis - Second Edition by Alexey Kleymenov & Amr Thabet

Author:Alexey Kleymenov & Amr Thabet
Language: eng
Format: epub
Publisher: Packt
Published: 2022-11-15T00:00:00+00:00

Linux shellcode for ARM

The shellcode on ARM systems is very similar to the shellcode that uses the x86 instruction set. It’s even easier for the shellcode authors to write in ARM as they don’t have to use the call/pop technique or fstenv to get the absolute address. In ARM assembly language, you can access the program counter register (pc) directly from the code, which makes this even simpler. Instead of int 0x80 or syscall, the shellcode uses svc #0 or svc #1 to execute a system function. An example of ARM shellcode for executing a local shell is as follows:

_start: add r0, pc, #12 mov r1, #0 mov r2, #0 mov r7, #11 ; execve system call ID svc #1 .ascii "/bin/sh"

In the preceding code, the shellcode sets r0 with the program counter (pc) + 12 to point to the /bin/sh string. Then, it sets the remaining arguments for the execve system call and calls the svc instruction to execute the code.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.