Skip to content

Instantly share code, notes, and snippets.

@vtols
Last active December 10, 2015 05:38
Show Gist options
  • Save vtols/4389475 to your computer and use it in GitHub Desktop.
Save vtols/4389475 to your computer and use it in GitHub Desktop.
from ctypes import c_int, create_string_buffer, CDLL, CFUNCTYPE
import os, ctypes
PROT_NONE = 0x0
PROT_READ = 0x1
PROT_WRITE = 0x2
PROT_EXEC = 0x4
MAP_PRIVATE = 0x02
MAP_ANONYMOUS = 0x20
sx = 48691458
icodes = [0x90, 0xB8, 0x00, 0x00,
0x00, 0x00, 0xC3]
for i in range(0, 4):
icodes[i + 2] = (sx >> (i * 8)) & 0xFF
hcodes = ''
for c in icodes:
hcodes += chr(c)
p = create_string_buffer(hcodes)
if os.name == 'posix':
libc = CDLL("libc.so.6")
mmap = libc.mmap
memmove = libc.memmove
vp = mmap(None,
len(icodes),
PROT_READ | PROT_WRITE | PROT_EXEC,
MAP_ANONYMOUS | MAP_PRIVATE,
0,
0)
memmove(vp, p, len(icodes))
p = vp
elif os.name == 'nt':
crt = CDLL("msvcrt")
malloc = crt.malloc
memmove = crt.memmove
vp = malloc(len(icodes))
memmove(vp, p, len(icodes))
p = vp
else:
print 'Unknown OS type'
exit(-1)
functype = CFUNCTYPE(c_int)
f = functype(p)
print "Call f()"
x = f()
print x
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment