Skip to content

Instantly share code, notes, and snippets.

@hc0d3r
Created April 16, 2018 14:31
Show Gist options
  • Save hc0d3r/74a000be0e55214a49ef254dfa6b27eb to your computer and use it in GitHub Desktop.
Save hc0d3r/74a000be0e55214a49ef254dfa6b27eb to your computer and use it in GitHub Desktop.
linux x86_64 system call using shellcode
// author: @hc0d3r
// license: wtfpl
#include <asm/unistd_64.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <stdio.h>
static const char syscall_sc[]=
"\x48\x89\xf8" // mov %rdi,%rax
"\x48\x89\xf7" // mov %rsi,%rdi
"\x48\x89\xd6" // mov %rdx,%rsi
"\x48\x89\xca" // mov %rcx,%rdx
"\x4d\x89\xc2" // mov %r8,%r10
"\x4d\x89\xc8" // mov %r9,%r8
"\x4c\x8b\x4c\x24\x08" // mov 0x8(%rsp),%r9
"\x0f\x05" // syscall
"\xc3"; // ret
#define x86_64_syscall(n, args...) ((long(*)(long, ...))(syscall_sc))(n, args)
int main(void){
char msg[]="Mommy I know the System V ABI\n";
x86_64_syscall(__NR_write, 1, msg, sizeof(msg)-1);
void *map_addr = (void*)x86_64_syscall(__NR_mmap, 0x13370000, 4096, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
printf("addr = %p\n", map_addr);
int fd = x86_64_syscall(__NR_open, "/etc/issue", O_RDONLY);
printf("fd = %d\n", fd);
x86_64_syscall(__NR_close, fd);
x86_64_syscall(__NR_munmap, map_addr, 4096);
x86_64_syscall(__NR_exit, 5);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment