This was really cool to make, but I'm not sure if it makes any sense to use this when radare2 exists...
The idea of this project is to make it easier to do some cool assembly tricks,
the first one I wanted to attack was pushing opcodes onto the stack and then
calling rsp to acheieve eval
-like behavior. I also wanted to keep it pure bash
because it seeems like between nasm, objdump, and standard bash utils we should
have more than enough power to do anything in assembly that the most twisted mind
could ever dream of and every time you add a component you're introducing another
things that downstream consumers have to manage and another thing that is
eventually going to break. I target x86_64 because it's what every dev environment
I've touched in the last 5 years runs. I use NASM instead of GAS or TASM or MASM
because I like it more.
scripts/getOpcodes.sh
takes lines of x86-64 nasm assembly and converts them into opcodes, pipe in a file or use it as an interactive assembler.scripts/functions.inc
provides the execWithOpcode function that accepts two bash "lamdas" as arguments, see the location of PLACEHOLDER 1 and PLACEHOLDER 2 in getOpcodes for all avaiable variables. The first can execute against $byte, which will be filled with each byte of each opcode in turn, the second can execute against $opCode which will be filled with the byte sequence making up each opcode in turnscripts/getPushes.sh
takes lines of x86-64 nasm assembly and at the end spits out pushAsm.asm containing (hopefully) legal push instructions containing the opcodes of the instructions taken from stdin with the byte order of the opcodes reversed to facilitate calling rsp, followed by thecall rsp
instruction. It also createsopcodesToPush
, a file conatining lines consisting of one ascii ascii hex byte each.scripts/bytesToAsm.sh
takes lines from stdin consisting of one ascii hex byte(like the ones found in the output ofgetOpcodes.sh
andgetPushes.sh
) each and shows you what assembly instructions the sequencer would make of themmake
takes one argument, let's call it$filename
.make
will generate an elf-64 binary from a Nasm x86_64 assembly program named "$filename
.asm" Along the way it might generate a warning about a missing_start
label. I'm still working on that. The binary should still work.
gadgets/exit.asm
calls the exit syscall. Clobbers raxgadgets/exit0.asm
zeroes rdi and calls the exit syscall. Clobbers rax, rdigadgets/pushEpilogue.asm
calls rsp, automatically added to the end of programs generated byscripts/getPushes.sh
. Clobbers rsp, stackgadgets/pushExample.asm
inserts 4 into dil, the lowest byte of rdi, which is the register used as the return code by the exit syscall. Clobbers dil, rsp, stack
./scripts/getPushes.sh < gadgets/pushExample.asm
cat gadgets/exit.asm >> pushAsm.asm
make pushAsm
./!$
echo $?