jonatanSh / shelf

Python library to convert elf to os-independent shellcodes
MIT License
44 stars 3 forks source link

Return value on intel_x32 #14

Closed TheOiseth closed 1 year ago

TheOiseth commented 1 year ago

First of all, this is a really cool project! It looks like for architecture intel_x32 return value of shellcode is incorrect, for me it was always 0x4. For aarch64 and intel_x64 it works well. shellcode function:

int main(){
    return 0xDEAD;
}

For loader I use a slightly modified shellcodeloader.c:

...
printf("Jumping to shellcode, address = %p \n", start_address);
void* retval = ((void* (*)(int argc, char **argv, char **envp)) start_address)(argc, argv, envp);
printf("retval %p\n", retval);
goto cleanups;
...

Is this behavior correct?

jonatanSh commented 1 year ago

Thank you for reporting, this issue isn't the correct behavior and I fixed it in version 2.2.3 for intel x32 arch, this bug still exists in the mips architecture and I'll fix it in feature versions also I added tests for return values 😄

TheOiseth commented 1 year ago

Great! I also have a suggestion regarding shellcode information. Is it possible to pass the following information to main as additional two parameters: the start address of the shellcode and its size? At the moment, I can pass this information in 1 and 2 arguments in the main function: long long value = ((int (*)(void* argc, void* argv, char **envp)) start_address)(start_address, buff_size, envp); But it would be great if the miniloader calculated these values itself. What do you think?

jonatanSh commented 1 year ago

I've fixed the issue with the return value for all supported architectures. About getting more information about the shellcode in its entry point, it is possible to pass a struct containing this information. But there's a feature called dynamic shellcodes, you can read more about it here: https://github.com/jonatanSh/elf_to_shellcode/blob/master/docs/dynamic.md This feature add support for calling functions declared inside the loader, therefore getting the relocatable table containing information such as shellcode size. It is currently only supported for mips and intel x64, but in future versions will be supported in all arches. For example on how to use this feature you can take a look at the tests: https://github.com/jonatanSh/elf_to_shellcode/blob/master/tests/elf_features.c