├── .gitattributes ├── CMakeLists.txt ├── LICENSE ├── PyShellCode ├── CImp.py ├── PythonImp.py ├── Simple.py └── __init__.py ├── README.md ├── examples ├── collatz.py ├── example_shellcode_file ├── flush_and_flush.py ├── flush_and_reload.py ├── fr_spy.py ├── from_file.py ├── from_nasmcode.py ├── from_shellcode.py └── using_arguments.py ├── include └── PyShellCode.h.in ├── setup.py ├── setup.py.in ├── src ├── CommandLineArgumentGlue.asm └── PyShellCode.c.in └── tools ├── Makefile ├── create_shellcode.sh ├── flush.asm ├── hello_world.asm ├── mfence.asm ├── probabilistic_password_checker.c ├── rdtsc.asm ├── simple_cache_leak_test.asm └── simple_cache_leak_test.c /.gitattributes: -------------------------------------------------------------------------------- 1 | *.in linguist-language=C 2 | *.h.in linguist-language=C 3 | *.c.in linguist-language=C 4 | -------------------------------------------------------------------------------- /CMakeLists.txt: -------------------------------------------------------------------------------- 1 | cmake_minimum_required (VERSION 2.8.12) 2 | 3 | set(CMAKE_C_COMPILER gcc) 4 | 5 | project (PyShellCode C ASM_NASM) 6 | set (PyShellCode_VERSION_MAJOR 1) 7 | set (PyShellCode_VERSION_MINOR 0) 8 | 9 | set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} "${PROJECT_SOURCE_DIR}/cmake") 10 | 11 | # -O3 causes segmentation faults ... 12 | set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -O0 -Wall -Wextra -g -e _main -ggdb3") 13 | SET(CMAKE_ASM_FLAGS "${CMAKE_C_FLAGS} -x assembler-with-cpp" ) 14 | 15 | set(INTERPRETER_DESCRIPTION "Requesting program interpreter:") 16 | 17 | execute_process(COMMAND readelf -l /bin/ls 18 | RESULT_VARIABLE return_value 19 | OUTPUT_VARIABLE result 20 | ) 21 | 22 | if(return_value) 23 | message(STATUS "Cannot find a valid ELF interpreter") 24 | else() 25 | string(REGEX REPLACE 26 | ".*[[]${INTERPRETER_DESCRIPTION} ([/][^ ].+)[]].*" "\\1" 27 | ELF_INTERPRETER_PATH "${result}" 28 | ) 29 | message(STATUS "ELF interpreter is ${ELF_INTERPRETER_PATH}") 30 | endif() 31 | 32 | configure_file ( 33 | "${PROJECT_SOURCE_DIR}/include/PyShellCode.h.in" 34 | "${PROJECT_BINARY_DIR}/include/PyShellCode.h" 35 | ) 36 | 37 | configure_file ( 38 | "${PROJECT_SOURCE_DIR}/src/PyShellCode.c.in" 39 | "${PROJECT_BINARY_DIR}/src/PyShellCode.c" 40 | ) 41 | 42 | include_directories("${PROJECT_SOURCE_DIR}/include/" "${PROJECT_BINARY_DIR}/include/") 43 | 44 | set(PyShellCode_SOURCES 45 | "${PROJECT_BINARY_DIR}/src/PyShellCode.c" 46 | "${PROJECT_SOURCE_DIR}/src/CommandLineArgumentGlue.asm" 47 | ) 48 | 49 | set(PyShellCode_HEADERS 50 | "${PROJECT_BINARY_DIR}/include/PyShellCode.h" 51 | ) 52 | 53 | 54 | add_library(PyShellCode SHARED ${PyShellCode_SOURCES} ${PyShellCode_HEADERS}) 55 | target_link_libraries(PyShellCode) 56 | 57 | install(TARGETS PyShellCode 58 | LIBRARY DESTINATION lib 59 | ARCHIVE DESTINATION lib 60 | RUNTIME DESTINATION bin 61 | ) 62 | 63 | install(FILES ${PyShellCode_HEADERS} DESTINATION include) 64 | 65 | find_program(PYTHON "python3") 66 | 67 | if (PYTHON) 68 | configure_file( 69 | "${PROJECT_SOURCE_DIR}/setup.py.in" 70 | "${PROJECT_SOURCE_DIR}/setup.py" 71 | ) 72 | 73 | add_custom_command(OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/build/timestamp" 74 | COMMAND ${PYTHON} "${CMAKE_CURRENT_BINARY_DIR}/setup.py" build 75 | COMMAND ${CMAKE_COMMAND} -E touch "${CMAKE_CURRENT_BINARY_DIR}/build/timestamp" 76 | DEPENDS ${DEPS}) 77 | 78 | add_custom_target(target ALL DEPENDS ${OUTPUT}) 79 | 80 | install(CODE "execute_process(COMMAND ${PYTHON} ${PROJECT_SOURCE_DIR}/setup.py install --prefix=${CMAKE_INSTALL_PREFIX})") 81 | endif() 82 | 83 | set(CPACK_PACKAGE_VERSION "${PyShellCode_VERSION_MAJOR}.${PyShellCode_VERSION_MINOR}") 84 | set(CPACK_GENERATOR "RPM;DEB;TGZ") 85 | set(CPACK_PACKAGE_NAME "PyShellCode") 86 | set(CPACK_PACKAGE_RELEASE 1) 87 | set(CPACK_PACKAGE_CONTACT "thomas.keck2@kit.edu") 88 | set(CPACK_PACKAGE_VENDOR "Private") 89 | set(CPACK_PACKAGING_INSTALL_PREFIX ${CMAKE_INSTALL_PREFIX}) 90 | set(CPACK_PACKAGE_FILE_NAME "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-${CPACK_PACKAGE_RELEASE}.${CMAKE_SYSTEM_PROCESSOR}") 91 | 92 | SET(CPACK_DEBIAN_PACKAGE_PRIORITY "optional") 93 | SET(CPACK_DEBIAN_PACKAGE_SECTION "libs") 94 | SET(CPACK_DEBIAN_ARCHITECTURE ${CMAKE_SYSTEM_PROCESSOR}) 95 | 96 | include(CPack) 97 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | GNU GENERAL PUBLIC LICENSE 2 | Version 3, 29 June 2007 3 | 4 | Copyright (C) 2007 Free Software Foundation, Inc. 5 | Everyone is permitted to copy and distribute verbatim copies 6 | of this license document, but changing it is not allowed. 7 | 8 | Preamble 9 | 10 | The GNU General Public License is a free, copyleft license for 11 | software and other kinds of works. 12 | 13 | The licenses for most software and other practical works are designed 14 | to take away your freedom to share and change the works. By contrast, 15 | the GNU General Public License is intended to guarantee your freedom to 16 | share and change all versions of a program--to make sure it remains free 17 | software for all its users. We, the Free Software Foundation, use the 18 | GNU General Public License for most of our software; it applies also to 19 | any other work released this way by its authors. You can apply it to 20 | your programs, too. 21 | 22 | When we speak of free software, we are referring to freedom, not 23 | price. Our General Public Licenses are designed to make sure that you 24 | have the freedom to distribute copies of free software (and charge for 25 | them if you wish), that you receive source code or can get it if you 26 | want it, that you can change the software or use pieces of it in new 27 | free programs, and that you know you can do these things. 28 | 29 | To protect your rights, we need to prevent others from denying you 30 | these rights or asking you to surrender the rights. Therefore, you have 31 | certain responsibilities if you distribute copies of the software, or if 32 | you modify it: responsibilities to respect the freedom of others. 33 | 34 | For example, if you distribute copies of such a program, whether 35 | gratis or for a fee, you must pass on to the recipients the same 36 | freedoms that you received. You must make sure that they, too, receive 37 | or can get the source code. And you must show them these terms so they 38 | know their rights. 39 | 40 | Developers that use the GNU GPL protect your rights with two steps: 41 | (1) assert copyright on the software, and (2) offer you this License 42 | giving you legal permission to copy, distribute and/or modify it. 43 | 44 | For the developers' and authors' protection, the GPL clearly explains 45 | that there is no warranty for this free software. For both users' and 46 | authors' sake, the GPL requires that modified versions be marked as 47 | changed, so that their problems will not be attributed erroneously to 48 | authors of previous versions. 49 | 50 | Some devices are designed to deny users access to install or run 51 | modified versions of the software inside them, although the manufacturer 52 | can do so. This is fundamentally incompatible with the aim of 53 | protecting users' freedom to change the software. The systematic 54 | pattern of such abuse occurs in the area of products for individuals to 55 | use, which is precisely where it is most unacceptable. Therefore, we 56 | have designed this version of the GPL to prohibit the practice for those 57 | products. If such problems arise substantially in other domains, we 58 | stand ready to extend this provision to those domains in future versions 59 | of the GPL, as needed to protect the freedom of users. 60 | 61 | Finally, every program is threatened constantly by software patents. 62 | States should not allow patents to restrict development and use of 63 | software on general-purpose computers, but in those that do, we wish to 64 | avoid the special danger that patents applied to a free program could 65 | make it effectively proprietary. To prevent this, the GPL assures that 66 | patents cannot be used to render the program non-free. 67 | 68 | The precise terms and conditions for copying, distribution and 69 | modification follow. 70 | 71 | TERMS AND CONDITIONS 72 | 73 | 0. Definitions. 74 | 75 | "This License" refers to version 3 of the GNU General Public License. 76 | 77 | "Copyright" also means copyright-like laws that apply to other kinds of 78 | works, such as semiconductor masks. 79 | 80 | "The Program" refers to any copyrightable work licensed under this 81 | License. Each licensee is addressed as "you". "Licensees" and 82 | "recipients" may be individuals or organizations. 83 | 84 | To "modify" a work means to copy from or adapt all or part of the work 85 | in a fashion requiring copyright permission, other than the making of an 86 | exact copy. The resulting work is called a "modified version" of the 87 | earlier work or a work "based on" the earlier work. 88 | 89 | A "covered work" means either the unmodified Program or a work based 90 | on the Program. 91 | 92 | To "propagate" a work means to do anything with it that, without 93 | permission, would make you directly or secondarily liable for 94 | infringement under applicable copyright law, except executing it on a 95 | computer or modifying a private copy. Propagation includes copying, 96 | distribution (with or without modification), making available to the 97 | public, and in some countries other activities as well. 98 | 99 | To "convey" a work means any kind of propagation that enables other 100 | parties to make or receive copies. Mere interaction with a user through 101 | a computer network, with no transfer of a copy, is not conveying. 102 | 103 | An interactive user interface displays "Appropriate Legal Notices" 104 | to the extent that it includes a convenient and prominently visible 105 | feature that (1) displays an appropriate copyright notice, and (2) 106 | tells the user that there is no warranty for the work (except to the 107 | extent that warranties are provided), that licensees may convey the 108 | work under this License, and how to view a copy of this License. If 109 | the interface presents a list of user commands or options, such as a 110 | menu, a prominent item in the list meets this criterion. 111 | 112 | 1. Source Code. 113 | 114 | The "source code" for a work means the preferred form of the work 115 | for making modifications to it. "Object code" means any non-source 116 | form of a work. 117 | 118 | A "Standard Interface" means an interface that either is an official 119 | standard defined by a recognized standards body, or, in the case of 120 | interfaces specified for a particular programming language, one that 121 | is widely used among developers working in that language. 122 | 123 | The "System Libraries" of an executable work include anything, other 124 | than the work as a whole, that (a) is included in the normal form of 125 | packaging a Major Component, but which is not part of that Major 126 | Component, and (b) serves only to enable use of the work with that 127 | Major Component, or to implement a Standard Interface for which an 128 | implementation is available to the public in source code form. A 129 | "Major Component", in this context, means a major essential component 130 | (kernel, window system, and so on) of the specific operating system 131 | (if any) on which the executable work runs, or a compiler used to 132 | produce the work, or an object code interpreter used to run it. 133 | 134 | The "Corresponding Source" for a work in object code form means all 135 | the source code needed to generate, install, and (for an executable 136 | work) run the object code and to modify the work, including scripts to 137 | control those activities. However, it does not include the work's 138 | System Libraries, or general-purpose tools or generally available free 139 | programs which are used unmodified in performing those activities but 140 | which are not part of the work. For example, Corresponding Source 141 | includes interface definition files associated with source files for 142 | the work, and the source code for shared libraries and dynamically 143 | linked subprograms that the work is specifically designed to require, 144 | such as by intimate data communication or control flow between those 145 | subprograms and other parts of the work. 146 | 147 | The Corresponding Source need not include anything that users 148 | can regenerate automatically from other parts of the Corresponding 149 | Source. 150 | 151 | The Corresponding Source for a work in source code form is that 152 | same work. 153 | 154 | 2. Basic Permissions. 155 | 156 | All rights granted under this License are granted for the term of 157 | copyright on the Program, and are irrevocable provided the stated 158 | conditions are met. This License explicitly affirms your unlimited 159 | permission to run the unmodified Program. The output from running a 160 | covered work is covered by this License only if the output, given its 161 | content, constitutes a covered work. This License acknowledges your 162 | rights of fair use or other equivalent, as provided by copyright law. 163 | 164 | You may make, run and propagate covered works that you do not 165 | convey, without conditions so long as your license otherwise remains 166 | in force. You may convey covered works to others for the sole purpose 167 | of having them make modifications exclusively for you, or provide you 168 | with facilities for running those works, provided that you comply with 169 | the terms of this License in conveying all material for which you do 170 | not control copyright. Those thus making or running the covered works 171 | for you must do so exclusively on your behalf, under your direction 172 | and control, on terms that prohibit them from making any copies of 173 | your copyrighted material outside their relationship with you. 174 | 175 | Conveying under any other circumstances is permitted solely under 176 | the conditions stated below. Sublicensing is not allowed; section 10 177 | makes it unnecessary. 178 | 179 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law. 180 | 181 | No covered work shall be deemed part of an effective technological 182 | measure under any applicable law fulfilling obligations under article 183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or 184 | similar laws prohibiting or restricting circumvention of such 185 | measures. 186 | 187 | When you convey a covered work, you waive any legal power to forbid 188 | circumvention of technological measures to the extent such circumvention 189 | is effected by exercising rights under this License with respect to 190 | the covered work, and you disclaim any intention to limit operation or 191 | modification of the work as a means of enforcing, against the work's 192 | users, your or third parties' legal rights to forbid circumvention of 193 | technological measures. 194 | 195 | 4. Conveying Verbatim Copies. 196 | 197 | You may convey verbatim copies of the Program's source code as you 198 | receive it, in any medium, provided that you conspicuously and 199 | appropriately publish on each copy an appropriate copyright notice; 200 | keep intact all notices stating that this License and any 201 | non-permissive terms added in accord with section 7 apply to the code; 202 | keep intact all notices of the absence of any warranty; and give all 203 | recipients a copy of this License along with the Program. 204 | 205 | You may charge any price or no price for each copy that you convey, 206 | and you may offer support or warranty protection for a fee. 207 | 208 | 5. Conveying Modified Source Versions. 209 | 210 | You may convey a work based on the Program, or the modifications to 211 | produce it from the Program, in the form of source code under the 212 | terms of section 4, provided that you also meet all of these conditions: 213 | 214 | a) The work must carry prominent notices stating that you modified 215 | it, and giving a relevant date. 216 | 217 | b) The work must carry prominent notices stating that it is 218 | released under this License and any conditions added under section 219 | 7. This requirement modifies the requirement in section 4 to 220 | "keep intact all notices". 221 | 222 | c) You must license the entire work, as a whole, under this 223 | License to anyone who comes into possession of a copy. This 224 | License will therefore apply, along with any applicable section 7 225 | additional terms, to the whole of the work, and all its parts, 226 | regardless of how they are packaged. This License gives no 227 | permission to license the work in any other way, but it does not 228 | invalidate such permission if you have separately received it. 229 | 230 | d) If the work has interactive user interfaces, each must display 231 | Appropriate Legal Notices; however, if the Program has interactive 232 | interfaces that do not display Appropriate Legal Notices, your 233 | work need not make them do so. 234 | 235 | A compilation of a covered work with other separate and independent 236 | works, which are not by their nature extensions of the covered work, 237 | and which are not combined with it such as to form a larger program, 238 | in or on a volume of a storage or distribution medium, is called an 239 | "aggregate" if the compilation and its resulting copyright are not 240 | used to limit the access or legal rights of the compilation's users 241 | beyond what the individual works permit. Inclusion of a covered work 242 | in an aggregate does not cause this License to apply to the other 243 | parts of the aggregate. 244 | 245 | 6. Conveying Non-Source Forms. 246 | 247 | You may convey a covered work in object code form under the terms 248 | of sections 4 and 5, provided that you also convey the 249 | machine-readable Corresponding Source under the terms of this License, 250 | in one of these ways: 251 | 252 | a) Convey the object code in, or embodied in, a physical product 253 | (including a physical distribution medium), accompanied by the 254 | Corresponding Source fixed on a durable physical medium 255 | customarily used for software interchange. 256 | 257 | b) Convey the object code in, or embodied in, a physical product 258 | (including a physical distribution medium), accompanied by a 259 | written offer, valid for at least three years and valid for as 260 | long as you offer spare parts or customer support for that product 261 | model, to give anyone who possesses the object code either (1) a 262 | copy of the Corresponding Source for all the software in the 263 | product that is covered by this License, on a durable physical 264 | medium customarily used for software interchange, for a price no 265 | more than your reasonable cost of physically performing this 266 | conveying of source, or (2) access to copy the 267 | Corresponding Source from a network server at no charge. 268 | 269 | c) Convey individual copies of the object code with a copy of the 270 | written offer to provide the Corresponding Source. This 271 | alternative is allowed only occasionally and noncommercially, and 272 | only if you received the object code with such an offer, in accord 273 | with subsection 6b. 274 | 275 | d) Convey the object code by offering access from a designated 276 | place (gratis or for a charge), and offer equivalent access to the 277 | Corresponding Source in the same way through the same place at no 278 | further charge. You need not require recipients to copy the 279 | Corresponding Source along with the object code. If the place to 280 | copy the object code is a network server, the Corresponding Source 281 | may be on a different server (operated by you or a third party) 282 | that supports equivalent copying facilities, provided you maintain 283 | clear directions next to the object code saying where to find the 284 | Corresponding Source. Regardless of what server hosts the 285 | Corresponding Source, you remain obligated to ensure that it is 286 | available for as long as needed to satisfy these requirements. 287 | 288 | e) Convey the object code using peer-to-peer transmission, provided 289 | you inform other peers where the object code and Corresponding 290 | Source of the work are being offered to the general public at no 291 | charge under subsection 6d. 292 | 293 | A separable portion of the object code, whose source code is excluded 294 | from the Corresponding Source as a System Library, need not be 295 | included in conveying the object code work. 296 | 297 | A "User Product" is either (1) a "consumer product", which means any 298 | tangible personal property which is normally used for personal, family, 299 | or household purposes, or (2) anything designed or sold for incorporation 300 | into a dwelling. In determining whether a product is a consumer product, 301 | doubtful cases shall be resolved in favor of coverage. For a particular 302 | product received by a particular user, "normally used" refers to a 303 | typical or common use of that class of product, regardless of the status 304 | of the particular user or of the way in which the particular user 305 | actually uses, or expects or is expected to use, the product. A product 306 | is a consumer product regardless of whether the product has substantial 307 | commercial, industrial or non-consumer uses, unless such uses represent 308 | the only significant mode of use of the product. 309 | 310 | "Installation Information" for a User Product means any methods, 311 | procedures, authorization keys, or other information required to install 312 | and execute modified versions of a covered work in that User Product from 313 | a modified version of its Corresponding Source. The information must 314 | suffice to ensure that the continued functioning of the modified object 315 | code is in no case prevented or interfered with solely because 316 | modification has been made. 317 | 318 | If you convey an object code work under this section in, or with, or 319 | specifically for use in, a User Product, and the conveying occurs as 320 | part of a transaction in which the right of possession and use of the 321 | User Product is transferred to the recipient in perpetuity or for a 322 | fixed term (regardless of how the transaction is characterized), the 323 | Corresponding Source conveyed under this section must be accompanied 324 | by the Installation Information. But this requirement does not apply 325 | if neither you nor any third party retains the ability to install 326 | modified object code on the User Product (for example, the work has 327 | been installed in ROM). 328 | 329 | The requirement to provide Installation Information does not include a 330 | requirement to continue to provide support service, warranty, or updates 331 | for a work that has been modified or installed by the recipient, or for 332 | the User Product in which it has been modified or installed. Access to a 333 | network may be denied when the modification itself materially and 334 | adversely affects the operation of the network or violates the rules and 335 | protocols for communication across the network. 336 | 337 | Corresponding Source conveyed, and Installation Information provided, 338 | in accord with this section must be in a format that is publicly 339 | documented (and with an implementation available to the public in 340 | source code form), and must require no special password or key for 341 | unpacking, reading or copying. 342 | 343 | 7. Additional Terms. 344 | 345 | "Additional permissions" are terms that supplement the terms of this 346 | License by making exceptions from one or more of its conditions. 347 | Additional permissions that are applicable to the entire Program shall 348 | be treated as though they were included in this License, to the extent 349 | that they are valid under applicable law. If additional permissions 350 | apply only to part of the Program, that part may be used separately 351 | under those permissions, but the entire Program remains governed by 352 | this License without regard to the additional permissions. 353 | 354 | When you convey a copy of a covered work, you may at your option 355 | remove any additional permissions from that copy, or from any part of 356 | it. (Additional permissions may be written to require their own 357 | removal in certain cases when you modify the work.) You may place 358 | additional permissions on material, added by you to a covered work, 359 | for which you have or can give appropriate copyright permission. 360 | 361 | Notwithstanding any other provision of this License, for material you 362 | add to a covered work, you may (if authorized by the copyright holders of 363 | that material) supplement the terms of this License with terms: 364 | 365 | a) Disclaiming warranty or limiting liability differently from the 366 | terms of sections 15 and 16 of this License; or 367 | 368 | b) Requiring preservation of specified reasonable legal notices or 369 | author attributions in that material or in the Appropriate Legal 370 | Notices displayed by works containing it; or 371 | 372 | c) Prohibiting misrepresentation of the origin of that material, or 373 | requiring that modified versions of such material be marked in 374 | reasonable ways as different from the original version; or 375 | 376 | d) Limiting the use for publicity purposes of names of licensors or 377 | authors of the material; or 378 | 379 | e) Declining to grant rights under trademark law for use of some 380 | trade names, trademarks, or service marks; or 381 | 382 | f) Requiring indemnification of licensors and authors of that 383 | material by anyone who conveys the material (or modified versions of 384 | it) with contractual assumptions of liability to the recipient, for 385 | any liability that these contractual assumptions directly impose on 386 | those licensors and authors. 387 | 388 | All other non-permissive additional terms are considered "further 389 | restrictions" within the meaning of section 10. If the Program as you 390 | received it, or any part of it, contains a notice stating that it is 391 | governed by this License along with a term that is a further 392 | restriction, you may remove that term. If a license document contains 393 | a further restriction but permits relicensing or conveying under this 394 | License, you may add to a covered work material governed by the terms 395 | of that license document, provided that the further restriction does 396 | not survive such relicensing or conveying. 397 | 398 | If you add terms to a covered work in accord with this section, you 399 | must place, in the relevant source files, a statement of the 400 | additional terms that apply to those files, or a notice indicating 401 | where to find the applicable terms. 402 | 403 | Additional terms, permissive or non-permissive, may be stated in the 404 | form of a separately written license, or stated as exceptions; 405 | the above requirements apply either way. 406 | 407 | 8. Termination. 408 | 409 | You may not propagate or modify a covered work except as expressly 410 | provided under this License. Any attempt otherwise to propagate or 411 | modify it is void, and will automatically terminate your rights under 412 | this License (including any patent licenses granted under the third 413 | paragraph of section 11). 414 | 415 | However, if you cease all violation of this License, then your 416 | license from a particular copyright holder is reinstated (a) 417 | provisionally, unless and until the copyright holder explicitly and 418 | finally terminates your license, and (b) permanently, if the copyright 419 | holder fails to notify you of the violation by some reasonable means 420 | prior to 60 days after the cessation. 421 | 422 | Moreover, your license from a particular copyright holder is 423 | reinstated permanently if the copyright holder notifies you of the 424 | violation by some reasonable means, this is the first time you have 425 | received notice of violation of this License (for any work) from that 426 | copyright holder, and you cure the violation prior to 30 days after 427 | your receipt of the notice. 428 | 429 | Termination of your rights under this section does not terminate the 430 | licenses of parties who have received copies or rights from you under 431 | this License. If your rights have been terminated and not permanently 432 | reinstated, you do not qualify to receive new licenses for the same 433 | material under section 10. 434 | 435 | 9. Acceptance Not Required for Having Copies. 436 | 437 | You are not required to accept this License in order to receive or 438 | run a copy of the Program. Ancillary propagation of a covered work 439 | occurring solely as a consequence of using peer-to-peer transmission 440 | to receive a copy likewise does not require acceptance. However, 441 | nothing other than this License grants you permission to propagate or 442 | modify any covered work. These actions infringe copyright if you do 443 | not accept this License. Therefore, by modifying or propagating a 444 | covered work, you indicate your acceptance of this License to do so. 445 | 446 | 10. Automatic Licensing of Downstream Recipients. 447 | 448 | Each time you convey a covered work, the recipient automatically 449 | receives a license from the original licensors, to run, modify and 450 | propagate that work, subject to this License. You are not responsible 451 | for enforcing compliance by third parties with this License. 452 | 453 | An "entity transaction" is a transaction transferring control of an 454 | organization, or substantially all assets of one, or subdividing an 455 | organization, or merging organizations. If propagation of a covered 456 | work results from an entity transaction, each party to that 457 | transaction who receives a copy of the work also receives whatever 458 | licenses to the work the party's predecessor in interest had or could 459 | give under the previous paragraph, plus a right to possession of the 460 | Corresponding Source of the work from the predecessor in interest, if 461 | the predecessor has it or can get it with reasonable efforts. 462 | 463 | You may not impose any further restrictions on the exercise of the 464 | rights granted or affirmed under this License. For example, you may 465 | not impose a license fee, royalty, or other charge for exercise of 466 | rights granted under this License, and you may not initiate litigation 467 | (including a cross-claim or counterclaim in a lawsuit) alleging that 468 | any patent claim is infringed by making, using, selling, offering for 469 | sale, or importing the Program or any portion of it. 470 | 471 | 11. Patents. 472 | 473 | A "contributor" is a copyright holder who authorizes use under this 474 | License of the Program or a work on which the Program is based. The 475 | work thus licensed is called the contributor's "contributor version". 476 | 477 | A contributor's "essential patent claims" are all patent claims 478 | owned or controlled by the contributor, whether already acquired or 479 | hereafter acquired, that would be infringed by some manner, permitted 480 | by this License, of making, using, or selling its contributor version, 481 | but do not include claims that would be infringed only as a 482 | consequence of further modification of the contributor version. For 483 | purposes of this definition, "control" includes the right to grant 484 | patent sublicenses in a manner consistent with the requirements of 485 | this License. 486 | 487 | Each contributor grants you a non-exclusive, worldwide, royalty-free 488 | patent license under the contributor's essential patent claims, to 489 | make, use, sell, offer for sale, import and otherwise run, modify and 490 | propagate the contents of its contributor version. 491 | 492 | In the following three paragraphs, a "patent license" is any express 493 | agreement or commitment, however denominated, not to enforce a patent 494 | (such as an express permission to practice a patent or covenant not to 495 | sue for patent infringement). To "grant" such a patent license to a 496 | party means to make such an agreement or commitment not to enforce a 497 | patent against the party. 498 | 499 | If you convey a covered work, knowingly relying on a patent license, 500 | and the Corresponding Source of the work is not available for anyone 501 | to copy, free of charge and under the terms of this License, through a 502 | publicly available network server or other readily accessible means, 503 | then you must either (1) cause the Corresponding Source to be so 504 | available, or (2) arrange to deprive yourself of the benefit of the 505 | patent license for this particular work, or (3) arrange, in a manner 506 | consistent with the requirements of this License, to extend the patent 507 | license to downstream recipients. "Knowingly relying" means you have 508 | actual knowledge that, but for the patent license, your conveying the 509 | covered work in a country, or your recipient's use of the covered work 510 | in a country, would infringe one or more identifiable patents in that 511 | country that you have reason to believe are valid. 512 | 513 | If, pursuant to or in connection with a single transaction or 514 | arrangement, you convey, or propagate by procuring conveyance of, a 515 | covered work, and grant a patent license to some of the parties 516 | receiving the covered work authorizing them to use, propagate, modify 517 | or convey a specific copy of the covered work, then the patent license 518 | you grant is automatically extended to all recipients of the covered 519 | work and works based on it. 520 | 521 | A patent license is "discriminatory" if it does not include within 522 | the scope of its coverage, prohibits the exercise of, or is 523 | conditioned on the non-exercise of one or more of the rights that are 524 | specifically granted under this License. You may not convey a covered 525 | work if you are a party to an arrangement with a third party that is 526 | in the business of distributing software, under which you make payment 527 | to the third party based on the extent of your activity of conveying 528 | the work, and under which the third party grants, to any of the 529 | parties who would receive the covered work from you, a discriminatory 530 | patent license (a) in connection with copies of the covered work 531 | conveyed by you (or copies made from those copies), or (b) primarily 532 | for and in connection with specific products or compilations that 533 | contain the covered work, unless you entered into that arrangement, 534 | or that patent license was granted, prior to 28 March 2007. 535 | 536 | Nothing in this License shall be construed as excluding or limiting 537 | any implied license or other defenses to infringement that may 538 | otherwise be available to you under applicable patent law. 539 | 540 | 12. No Surrender of Others' Freedom. 541 | 542 | If conditions are imposed on you (whether by court order, agreement or 543 | otherwise) that contradict the conditions of this License, they do not 544 | excuse you from the conditions of this License. If you cannot convey a 545 | covered work so as to satisfy simultaneously your obligations under this 546 | License and any other pertinent obligations, then as a consequence you may 547 | not convey it at all. For example, if you agree to terms that obligate you 548 | to collect a royalty for further conveying from those to whom you convey 549 | the Program, the only way you could satisfy both those terms and this 550 | License would be to refrain entirely from conveying the Program. 551 | 552 | 13. Use with the GNU Affero General Public License. 553 | 554 | Notwithstanding any other provision of this License, you have 555 | permission to link or combine any covered work with a work licensed 556 | under version 3 of the GNU Affero General Public License into a single 557 | combined work, and to convey the resulting work. The terms of this 558 | License will continue to apply to the part which is the covered work, 559 | but the special requirements of the GNU Affero General Public License, 560 | section 13, concerning interaction through a network will apply to the 561 | combination as such. 562 | 563 | 14. Revised Versions of this License. 564 | 565 | The Free Software Foundation may publish revised and/or new versions of 566 | the GNU General Public License from time to time. Such new versions will 567 | be similar in spirit to the present version, but may differ in detail to 568 | address new problems or concerns. 569 | 570 | Each version is given a distinguishing version number. If the 571 | Program specifies that a certain numbered version of the GNU General 572 | Public License "or any later version" applies to it, you have the 573 | option of following the terms and conditions either of that numbered 574 | version or of any later version published by the Free Software 575 | Foundation. If the Program does not specify a version number of the 576 | GNU General Public License, you may choose any version ever published 577 | by the Free Software Foundation. 578 | 579 | If the Program specifies that a proxy can decide which future 580 | versions of the GNU General Public License can be used, that proxy's 581 | public statement of acceptance of a version permanently authorizes you 582 | to choose that version for the Program. 583 | 584 | Later license versions may give you additional or different 585 | permissions. However, no additional obligations are imposed on any 586 | author or copyright holder as a result of your choosing to follow a 587 | later version. 588 | 589 | 15. Disclaimer of Warranty. 590 | 591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY 592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT 593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY 594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, 595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 596 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM 597 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF 598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 599 | 600 | 16. Limitation of Liability. 601 | 602 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS 604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY 605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE 606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF 607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD 608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), 609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 610 | SUCH DAMAGES. 611 | 612 | 17. Interpretation of Sections 15 and 16. 613 | 614 | If the disclaimer of warranty and limitation of liability provided 615 | above cannot be given local legal effect according to their terms, 616 | reviewing courts shall apply local law that most closely approximates 617 | an absolute waiver of all civil liability in connection with the 618 | Program, unless a warranty or assumption of liability accompanies a 619 | copy of the Program in return for a fee. 620 | 621 | END OF TERMS AND CONDITIONS 622 | 623 | How to Apply These Terms to Your New Programs 624 | 625 | If you develop a new program, and you want it to be of the greatest 626 | possible use to the public, the best way to achieve this is to make it 627 | free software which everyone can redistribute and change under these terms. 628 | 629 | To do so, attach the following notices to the program. It is safest 630 | to attach them to the start of each source file to most effectively 631 | state the exclusion of warranty; and each file should have at least 632 | the "copyright" line and a pointer to where the full notice is found. 633 | 634 | {one line to give the program's name and a brief idea of what it does.} 635 | Copyright (C) {year} {name of author} 636 | 637 | This program is free software: you can redistribute it and/or modify 638 | it under the terms of the GNU General Public License as published by 639 | the Free Software Foundation, either version 3 of the License, or 640 | (at your option) any later version. 641 | 642 | This program is distributed in the hope that it will be useful, 643 | but WITHOUT ANY WARRANTY; without even the implied warranty of 644 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 645 | GNU General Public License for more details. 646 | 647 | You should have received a copy of the GNU General Public License 648 | along with this program. If not, see . 649 | 650 | Also add information on how to contact you by electronic and paper mail. 651 | 652 | If the program does terminal interaction, make it output a short 653 | notice like this when it starts in an interactive mode: 654 | 655 | {project} Copyright (C) {year} {fullname} 656 | This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. 657 | This is free software, and you are welcome to redistribute it 658 | under certain conditions; type `show c' for details. 659 | 660 | The hypothetical commands `show w' and `show c' should show the appropriate 661 | parts of the General Public License. Of course, your program's commands 662 | might be different; for a GUI interface, you would use an "about box". 663 | 664 | You should also get your employer (if you work as a programmer) or school, 665 | if any, to sign a "copyright disclaimer" for the program, if necessary. 666 | For more information on this, and how to apply and follow the GNU GPL, see 667 | . 668 | 669 | The GNU General Public License does not permit incorporating your program 670 | into proprietary programs. If your program is a subroutine library, you 671 | may consider it more useful to permit linking proprietary applications with 672 | the library. If this is what you want to do, use the GNU Lesser General 673 | Public License instead of this License. But first, please read 674 | . 675 | -------------------------------------------------------------------------------- /PyShellCode/CImp.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | 3 | import ctypes 4 | import ctypes.util 5 | 6 | import os 7 | import tempfile 8 | import subprocess 9 | 10 | PyShellCode_library = ctypes.cdll.LoadLibrary(os.getcwd() + '/libPyShellCode.so') 11 | print('Loaded ', PyShellCode_library) 12 | 13 | PyShellCode_library.create_ExecutableCode_from_ShellCode.restype = ctypes.c_void_p 14 | PyShellCode_library.create_ExecutableCode_from_ShellCode.argtypes = [ctypes.c_char_p, ctypes.c_uint] 15 | PyShellCode_library.create_ExecutableCode_from_File.restype = ctypes.c_void_p 16 | PyShellCode_library.create_ExecutableCode_from_File.argtypes = [ctypes.c_char_p] 17 | PyShellCode_library.valid_ExecutableCode.restype = ctypes.c_int 18 | PyShellCode_library.valid_ExecutableCode.argtypes = [ctypes.c_void_p] 19 | PyShellCode_library.execute_ExecutableCode.restype = ctypes.c_int64 20 | PyShellCode_library.execute_ExecutableCode.argtypes = [ctypes.c_void_p] 21 | PyShellCode_library.execute_with_void_ptr_ExecutableCode.restype = ctypes.c_int64 22 | PyShellCode_library.execute_with_void_ptr_ExecutableCode.argtypes = [ctypes.c_void_p, ctypes.c_void_p] 23 | PyShellCode_library.destroy_ExecutableCode.argtypes = [ctypes.c_void_p] 24 | PyShellCode_library.print_ExecutableCode.argtypes = [ctypes.c_void_p] 25 | 26 | 27 | def PrintVersion(): 28 | PyShellCode_library.PrintVersion() 29 | 30 | 31 | class ExecutableCode(object): 32 | def __init__(self, executable_code): 33 | self.executable_code = executable_code 34 | 35 | def print(self): 36 | PyShellCode_library.print_ExecutableCode(self.executable_code) 37 | 38 | def isValid(self): 39 | return PyShellCode_library.valid_ExecutableCode(self.executable_code) != 0 40 | 41 | def __call__(self, data=None): 42 | if data is None: 43 | return PyShellCode_library.execute_ExecutableCode(self.executable_code) 44 | else: 45 | ptr = ctypes.addressof(data) 46 | return PyShellCode_library.execute_with_void_ptr_ExecutableCode(self.executable_code, ptr) 47 | 48 | def __del__(self): 49 | PyShellCode_library.destroy_ExecutableCode(self.executable_code) 50 | 51 | @classmethod 52 | def from_NASMCode(cls, nasm_code): 53 | oldcwd = os.getcwd() 54 | with tempfile.TemporaryDirectory() as tempdir: 55 | os.chdir(tempdir) 56 | with open('shellcode.asm', 'w') as f: 57 | f.write("global _start\nsection .text\n_start:\n") 58 | f.write(nasm_code) 59 | subprocess.check_call("nasm -f elf64 shellcode.asm -o shellcode.o", shell=True) 60 | subprocess.check_call("ld -o shellcode shellcode.o", shell=True) 61 | output = subprocess.getoutput("objdump -d shellcode | tr '\t' ' ' | tr ' ' '\n' | egrep '^[0-9a-f]{2}$'") 62 | shell_code = bytes(map(lambda x: int(x, base=16), output.strip().split('\n'))) 63 | os.chdir(oldcwd) 64 | return cls.from_ShellCode(shell_code) 65 | 66 | @classmethod 67 | def from_ShellCode(cls, shell_code): 68 | if not isinstance(shell_code, bytes): 69 | shell_code = bytes(shell_code, 'utf-8') 70 | return cls(PyShellCode_library.create_ExecutableCode_from_ShellCode(ctypes.c_char_p(shell_code), len(shell_code))) 71 | 72 | @classmethod 73 | def from_File(cls, filename): 74 | return cls(PyShellCode_library.create_ExecutableCode_from_File(filename)) 75 | -------------------------------------------------------------------------------- /PyShellCode/PythonImp.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | 3 | import ctypes 4 | import ctypes.util 5 | 6 | import os 7 | import tempfile 8 | import subprocess 9 | import mmap 10 | 11 | 12 | class ExecutableCode(object): 13 | def __init__(self, memory_chunk, restype=ctypes.c_int64, *argtypes): 14 | self.restype = restype 15 | self.argtypes = argtypes 16 | self.memory_chunk = memory_chunk 17 | self.ctypes_buffer = ctypes.c_int.from_buffer(memory_chunk) 18 | self.executable_code = ctypes.CFUNCTYPE(self.restype, *argtypes)(ctypes.addressof(self.ctypes_buffer)) 19 | 20 | def print(self): 21 | print(self.memory_chunk) 22 | 23 | def isValid(self): 24 | return True 25 | 26 | def __call__(self, *data): 27 | return self.executable_code(*data) 28 | 29 | @classmethod 30 | def from_NASMCode(cls, nasm_code, restype=ctypes.c_int64, *argtypes): 31 | oldcwd = os.getcwd() 32 | with tempfile.TemporaryDirectory() as tempdir: 33 | os.chdir(tempdir) 34 | with open('shellcode.asm', 'w') as f: 35 | f.write("global _start\nsection .text\n_start:\n") 36 | f.write(nasm_code) 37 | subprocess.check_call("nasm -f elf64 shellcode.asm -o shellcode.o", shell=True) 38 | subprocess.check_call("ld -o shellcode shellcode.o", shell=True) 39 | output = subprocess.getoutput("objdump -d shellcode | tr '\t' ' ' | tr ' ' '\n' | egrep '^[0-9a-f]{2}$'") 40 | shell_code = bytes(map(lambda x: int(x, base=16), output.strip().split('\n'))) 41 | os.chdir(oldcwd) 42 | return cls.from_ShellCode(shell_code, restype, *argtypes) 43 | 44 | @classmethod 45 | def from_ShellCode(cls, shell_code, restype=ctypes.c_int64, *argtypes): 46 | if not isinstance(shell_code, bytes): 47 | shell_code = bytes(shell_code, 'utf-8') 48 | mm = mmap.mmap(-1, len(shell_code), flags=mmap.MAP_SHARED | mmap.MAP_ANONYMOUS, prot=mmap.PROT_WRITE | mmap.PROT_READ | mmap.PROT_EXEC) 49 | mm.write(shell_code) 50 | return cls(mm, restype, *argtypes) 51 | 52 | @classmethod 53 | def from_File(cls, filename, restype=ctypes.c_int64, *argtypes): 54 | with open(filename, 'rb') as f: 55 | shell_code = f.read() 56 | return cls.from_ShellCode(shell_code, restype, *argtypes ) 57 | -------------------------------------------------------------------------------- /PyShellCode/Simple.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | 3 | import ctypes 4 | import ctypes.util 5 | 6 | import os 7 | import tempfile 8 | import subprocess 9 | import mmap 10 | 11 | 12 | def create_shellcode_from_nasmcode(nasm_code): 13 | oldcwd = os.getcwd() 14 | with tempfile.TemporaryDirectory() as tempdir: 15 | os.chdir(tempdir) 16 | with open('shellcode.asm', 'w') as f: 17 | f.write("global _start\nsection .text\n_start:\n") 18 | f.write(nasm_code) 19 | subprocess.check_call("nasm -f elf64 shellcode.asm -o shellcode.o", shell=True) 20 | subprocess.check_call("ld -o shellcode shellcode.o", shell=True) 21 | output = subprocess.getoutput("objdump -d shellcode | tr '\t' ' ' | tr ' ' '\n' | egrep '^[0-9a-f]{2}$'") 22 | shell_code = bytes(map(lambda x: int(x, base=16), output.strip().split('\n'))) 23 | os.chdir(oldcwd) 24 | return shell_code 25 | 26 | 27 | def create_function_from_shellcode(shell_code, restype=ctypes.c_int64, argtypes=()): 28 | mm = mmap.mmap(-1, len(shell_code), flags=mmap.MAP_SHARED | mmap.MAP_ANONYMOUS, prot=mmap.PROT_WRITE | mmap.PROT_READ | mmap.PROT_EXEC) 29 | mm.write(shell_code) 30 | ctypes_buffer = ctypes.c_int.from_buffer(mm) 31 | function = ctypes.CFUNCTYPE(restype, *argtypes)(ctypes.addressof(ctypes_buffer)) 32 | function._avoid_gc_for_mmap = mm 33 | return function 34 | 35 | 36 | if __name__ == '__main__': 37 | text = b'Hallo Welt\n' 38 | data = (ctypes.c_char*len(text))() 39 | data[:] = text 40 | 41 | nasm_code = """ 42 | mov rax, 0x1 ; Parameter 0 -> Syscall Nr 43 | mov rsi, rdi ; Parameter 2 -> buffer is passed as first argument to the function call 44 | mov rdi, 0x1 ; Parameter 1 -> fd 45 | mov rdx, {length}; Parameter 3 -> length 46 | syscall 47 | ret 48 | """.format(length=len(text)) 49 | print("NASM code", nasm_code) 50 | 51 | shell_code = create_shellcode_from_nasmcode(nasm_code) 52 | print("ShellCode", shell_code) 53 | 54 | function = create_function_from_shellcode(shell_code, argtypes=(ctypes.c_void_p,)) 55 | print("Function", function) 56 | 57 | result = function(data) 58 | print("Result", result) 59 | -------------------------------------------------------------------------------- /PyShellCode/__init__.py: -------------------------------------------------------------------------------- 1 | from .PythonImp import * 2 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # PyShellCode 2 | 3 | Execute ShellCode in Python. 4 | In other words, allows to use "inline assembler" in Python. 5 | 6 | There are three implementations: 7 | * C Implementation (Cimp.py) -- which is called wrapped using ctypes for usage in python, but can be used standalone as well 8 | * Python3 Implementation (PythonImp.py) -- does not require the shared library which is build by cmake, has the same interface as CImp 9 | * Python3 Implementation (Simple.py) -- most condensed implementation, pure python, just two functions (**use this**) 10 | 11 | All the code is highly platform-dependent. In my case: 12 | Linux thinkpad 4.8.0-2-amd64 #1 SMP Debian 4.8.11-1 (2016-12-02) x86_64 GNU/Linux 13 | 14 | **This is intended as a simple project to learn more about x86-64 assembler and linux (see paragraph Other Work)** 15 | As well as serve for a easy platform to recreate cache-attacks and other side-channels attacks which require assembly. 16 | If you want to use the code to do something similar I recommend reading the paragraph **Technical Details** below 17 | and implement it yourself (or copy&paste Simple.py) since it's not hard once you know how-to do it. 18 | 19 | Contains also some interesting code for CMake, to build shared-libraries which are executable and take command line arguments. 20 | 21 | 22 | # Installation 23 | 24 | * cmake . 25 | * make 26 | * make install 27 | * make package (optional to build rpm, deb packages) 28 | 29 | and/or (latter if you only require the Python version) 30 | 31 | * python3 setup.py install 32 | 33 | 34 | # Technical Details 35 | 36 | At first we require some shell-code (a binary string containing the correct opcodes which can directly be executed by your CPU). 37 | One can create such a string by hand, or use an assembler like nasm to create it for you: 38 | 39 | For instance, create a file shellcode.asm 40 | 41 | ```asm 42 | global _start 43 | section .text 44 | _start: 45 | 46 | ``` 47 | 48 | and execute: 49 | 50 | ```bash 51 | nasm -f elf64 shellcode.asm -o shellcode.o 52 | ld -o shellcode shellcode.o 53 | for i in `objdump -d shellcode | tr '\t' ' ' | tr ' ' '\n' | egrep '^[0-9a-f]{2}$' ` ; do echo -n "\x$i" ; done 54 | ``` 55 | The function *create_shellcode_from_nasmcode* in *Simple.py* does this for you. 56 | 57 | A simple hello world shell-code looks like this 58 | ```python 59 | shell_code = b"\xeb\x13\xb8\x01\x00\x00\x00\xbf\x01\x00\x00\x00\x5e\xba\x0f\x00\x00\x00\x0f\x05\xc3\xe8\xe8\xff\xff\xff\x48\x65\x6c\x6c\x6f\x2c\x20\x57\x6f\x72\x6c\x64\x21\x0a" 60 | ``` 61 | 62 | **Side note**: *Traditional* shell-code is concerned with avoiding 0-bytes, because it is typically injected 63 | into a unvalided user-input request. This isn't a problem if you just want to execute your code as inline-assembler, 64 | because python-strings can contain 0-bytes. 65 | 66 | 67 | Secondly we create a pice of executable memory in python and write our shell-code into this memory 68 | 69 | ```python 70 | import mmap 71 | shell_code = b'' 72 | mm = mmap.mmap(-1, len(shell_code), flags=mmap.MAP_SHARED | mmap.MAP_ANONYMOUS, prot=mmap.PROT_WRITE | mmap.PROT_READ | mmap.PROT_EXEC) 73 | mm.write(shell_code) 74 | ``` 75 | 76 | Finally we obtain the address of the memory and create a C Function Pointer using ctypes and this address: 77 | ```python 78 | import ctypes 79 | restype = ctypes.c_int64 80 | argtypes = tuple() 81 | ctypes_buffer = ctypes.c_int.from_buffer(mm) 82 | function = ctypes.CFUNCTYPE(restype, *argtypes)(ctypes.addressof(ctypes_buffer)) 83 | function() 84 | ``` 85 | 86 | The function *create_function_from_shellcode* in *Simple.py* implements this. 87 | As I stated above this code was meant as a learn-project. 88 | I recommend using directly the code I described above (or Simple.py which basically contains this code) instead of PyShellCode itself, 89 | because the dependency on the shared-library of the C-Implementation is unnecessary for you. 90 | 91 | The C-Implementation looks similar. 92 | 93 | 94 | # Performance 95 | 96 | In my tests PyShellCode yields the expected performance e.g.: 97 | PyShellCode is 100 times faster than pure python and 10 times faster than numba 98 | for equivalent implementations for finding the longest period of the collatz-sequence below a threshold. 99 | 100 | python3 examples/collatz.py 101 | 102 | Python [6.17894043999695, 6.065295364998747, 6.235952811999596] 103 | 104 | Numba [0.603332129001501, 0.6196587439990253, 0.6055442029974074] 105 | 106 | PyShellCode [0.06954922499426175, 0.06870782400073949, 0.06622266400518129] 107 | 108 | 109 | # Resources 110 | 111 | * Linux Syscalls http://syscalls.kernelgrok.com/ 112 | * x86 Assembler http://x86.renejeschke.de/ 113 | * Flush+Flush Cache Attack https://github.com/IAIK/flush_flush 114 | * https://en.wikibooks.org/wiki/X86_Assembly/Interfacing_with_Linux 115 | 116 | 117 | # Other work 118 | * https://gist.github.com/dcoles/4071130 -- Very similar to the code provided here, but uses mprotect instead of mmap to create an executable buffer 119 | * https://github.com//pycca/pycca -- Does not depend on external assembler, you can write assembler code directly in python in form of statements, supports C as well (alpha) 120 | * https://github.com/Maratyszcza/PeachPy -- Write assembler in python, generates object files and more 121 | -------------------------------------------------------------------------------- /examples/collatz.py: -------------------------------------------------------------------------------- 1 | from PyShellCode import ExecutableCode 2 | 3 | import timeit 4 | 5 | N = 10000 6 | 7 | 8 | def python_maximum_collatz_length_below(): 9 | n = N 10 | max_n = 0 11 | max_length = 1 12 | for i in range(1, n): 13 | j = i 14 | length = 1 15 | while True: 16 | if i == 1: 17 | break 18 | if i % 2 == 0: 19 | i = i / 2 20 | else: 21 | i = 3 * i + 1 22 | length += 1 23 | if max_length < length: 24 | max_length = length 25 | max_n = j 26 | return max_n 27 | 28 | 29 | def nasm_maximum_collatz_length_below(): 30 | return """ 31 | push rbp ; 0000 _ 55 32 | mov rbp, rsp ; 0001 _ 48: 89. E5 33 | mov rdi, {number} 34 | mov qword [rbp-38H], rdi ; 0004 _ 48: 89. 7D, C8 35 | mov qword [rbp-8H], 0 ; 0008 _ 48: C7. 45, F8, 00000000 36 | mov qword [rbp-10H], 1 ; 0010 _ 48: C7. 45, F0, 00000001 37 | mov qword [rbp-18H], 1 ; 0018 _ 48: C7. 45, E8, 00000001 38 | jmp L_007 ; 0020 _ EB, 76 39 | 40 | L_001: mov rax, qword [rbp-18H] ; 0022 _ 48: 8B. 45, E8 41 | mov qword [rbp-20H], rax ; 0026 _ 48: 89. 45, E0 42 | mov qword [rbp-28H], 1 ; 002A _ 48: C7. 45, D8, 00000001 43 | L_002: cmp qword [rbp-20H], 1 ; 0032 _ 48: 83. 7D, E0, 01 44 | jz L_005 ; 0037 _ 74, 3F 45 | mov rax, qword [rbp-20H] ; 0039 _ 48: 8B. 45, E0 46 | and eax, 01H ; 003D _ 83. E0, 01 47 | test rax, rax ; 0040 _ 48: 85. C0 48 | jnz L_003 ; 0043 _ 75, 17 49 | mov rax, qword [rbp-20H] ; 0045 _ 48: 8B. 45, E0 50 | mov rdx, rax ; 0049 _ 48: 89. C2 51 | shr rdx, 63 ; 004C _ 48: C1. EA, 3F 52 | add rax, rdx ; 0050 _ 48: 01. D0 53 | sar rax, 1 ; 0053 _ 48: D1. F8 54 | mov qword [rbp-20H], rax ; 0056 _ 48: 89. 45, E0 55 | jmp L_004 ; 005A _ EB, 15 56 | 57 | L_003: mov rdx, qword [rbp-20H] ; 005C _ 48: 8B. 55, E0 58 | mov rax, rdx ; 0060 _ 48: 89. D0 59 | add rax, rax ; 0063 _ 48: 01. C0 60 | add rax, rdx ; 0066 _ 48: 01. D0 61 | add rax, 1 ; 0069 _ 48: 83. C0, 01 62 | mov qword [rbp-20H], rax ; 006D _ 48: 89. 45, E0 63 | L_004: add qword [rbp-28H], 1 ; 0071 _ 48: 83. 45, D8, 01 64 | jmp L_002 ; 0076 _ EB, BA 65 | 66 | L_005: nop ; 0078 _ 90 67 | mov rax, qword [rbp-10H] ; 0079 _ 48: 8B. 45, F0 68 | cmp rax, qword [rbp-28H] ; 007D _ 48: 3B. 45, D8 69 | jge L_006 ; 0081 _ 7D, 10 70 | mov rax, qword [rbp-28H] ; 0083 _ 48: 8B. 45, D8 71 | mov qword [rbp-10H], rax ; 0087 _ 48: 89. 45, F0 72 | mov rax, qword [rbp-18H] ; 008B _ 48: 8B. 45, E8 73 | mov qword [rbp-8H], rax ; 008F _ 48: 89. 45, F8 74 | L_006: add qword [rbp-18H], 1 ; 0093 _ 48: 83. 45, E8, 01 75 | L_007: mov rax, qword [rbp-18H] ; 0098 _ 48: 8B. 45, E8 76 | cmp rax, qword [rbp-38H] ; 009C _ 48: 3B. 45, C8 77 | jl L_001 ; 00A0 _ 7C, 80 78 | mov rax, qword [rbp-8H] ; 00A2 _ 48: 8B. 45, F8 79 | pop rbp ; 00A6 _ 5D 80 | ret ; 00A7 _ C3 81 | """.format(number=N) 82 | 83 | pyshellcode_maximum_collatz_length_below = ExecutableCode.from_NASMCode(nasm_maximum_collatz_length_below()) 84 | 85 | import numba 86 | numba_maximum_collatz_length_below = numba.jit()(python_maximum_collatz_length_below) 87 | 88 | if __name__ == '__main__': 89 | 90 | #print(python_maximum_collatz_length_below()) 91 | #print(numba_maximum_collatz_length_below()) 92 | #print(pyshellcode_maximum_collatz_length_below()) 93 | 94 | print("Python", timeit.repeat("python_maximum_collatz_length_below()", "from __main__ import python_maximum_collatz_length_below", number=10)) 95 | print("Numba", timeit.repeat("numba_maximum_collatz_length_below()", "from __main__ import numba_maximum_collatz_length_below", number=10)) 96 | print("PyShellCode", timeit.repeat("pyshellcode_maximum_collatz_length_below()", "from __main__ import pyshellcode_maximum_collatz_length_below", number=10)) 97 | 98 | -------------------------------------------------------------------------------- /examples/example_shellcode_file: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/thomaskeck/PyShellCode/f156234ff95f1c5968808d0f91ab44747a6b000d/examples/example_shellcode_file -------------------------------------------------------------------------------- /examples/flush_and_flush.py: -------------------------------------------------------------------------------- 1 | from PyShellCode import ExecutableCode 2 | 3 | import ctypes 4 | import numpy as np 5 | import matplotlib.pyplot as plt 6 | 7 | import pdb 8 | 9 | if __name__ == '__main__': 10 | array = (ctypes.c_ulong*(5*1024))() 11 | ptr = ctypes.addressof(array) + ctypes.sizeof(ctypes.c_ulong)*(2*1024) 12 | 13 | onlyreload_nasm_code = """ 14 | mov rbx, {ptr} 15 | mov rcx, [rbx] 16 | mov rcx, [rbx] 17 | cpuid 18 | mfence 19 | rdtsc 20 | shl rdx, 32 21 | or rax, rdx 22 | mfence 23 | mov rcx, rax ; Save rax 24 | mov rax, {ptr} 25 | clflush [rax] 26 | mfence 27 | rdtsc 28 | shl rdx, 32 29 | or rax, rdx 30 | mfence 31 | sub rax, rcx 32 | ret 33 | """.format(ptr=ptr) 34 | 35 | flushandreload_nasm_code = """ 36 | mov rbx, {ptr} 37 | mov rcx, [rbx] 38 | mov rcx, [rbx] 39 | cpuid 40 | mov rax, {ptr} 41 | clflush [rax] 42 | cpuid 43 | mfence 44 | rdtsc 45 | shl rdx, 32 46 | or rax, rdx 47 | mfence 48 | mov rcx, rax ; Save rax 49 | mov rax, {ptr} 50 | clflush [rax] 51 | mfence 52 | rdtsc 53 | shl rdx, 32 54 | or rax, rdx 55 | mfence 56 | sub rax, rcx 57 | ret 58 | """.format(ptr=ptr) 59 | 60 | onlyreload = ExecutableCode.from_NASMCode(onlyreload_nasm_code) 61 | flushandreload = ExecutableCode.from_NASMCode(flushandreload_nasm_code) 62 | 63 | N = 1*1024**2 64 | hits = np.zeros(N) 65 | for i in range(N): 66 | hits[i] = onlyreload() 67 | 68 | miss = np.zeros(N) 69 | for i in range(N): 70 | miss[i] = flushandreload() 71 | 72 | bins = 300 73 | plt.hist(hits[hits < bins], label='hits', bins=bins/5, alpha=0.5) 74 | plt.hist(miss[miss < bins], label='miss', bins=bins/5, alpha=0.5) 75 | plt.legend() 76 | plt.show() 77 | -------------------------------------------------------------------------------- /examples/flush_and_reload.py: -------------------------------------------------------------------------------- 1 | from PyShellCode import ExecutableCode 2 | 3 | import ctypes 4 | import numpy as np 5 | import matplotlib.pyplot as plt 6 | 7 | import pdb 8 | 9 | if __name__ == '__main__': 10 | array = (ctypes.c_ulong*(5*1024))() 11 | ptr = ctypes.addressof(array) + ctypes.sizeof(ctypes.c_ulong)*(2*1024) 12 | 13 | onlyreload_nasm_code = """ 14 | mfence 15 | rdtsc 16 | shl rdx, 32 17 | or rax, rdx 18 | mfence 19 | mov rcx, rax ; Save rax 20 | mov rbx, {ptr} 21 | mov rax, [rbx] 22 | mfence 23 | rdtsc 24 | shl rdx, 32 25 | or rax, rdx 26 | mfence 27 | sub rax, rcx 28 | ret 29 | """.format(ptr=ptr) 30 | 31 | flushandreload_nasm_code = """ 32 | mfence 33 | rdtsc 34 | shl rdx, 32 35 | or rax, rdx 36 | mfence 37 | mov rcx, rax ; Save rax 38 | mov rbx, {ptr} 39 | mov rax, [rbx] 40 | mfence 41 | rdtsc 42 | shl rdx, 32 43 | or rax, rdx 44 | mfence 45 | sub rax, rcx 46 | mov rcx, rax 47 | mov rax, {ptr} 48 | clflush [rax] 49 | mov rax, rcx 50 | ret 51 | """.format(ptr=ptr) 52 | 53 | onlyreload = ExecutableCode.from_NASMCode(onlyreload_nasm_code) 54 | flushandreload = ExecutableCode.from_NASMCode(flushandreload_nasm_code) 55 | 56 | N = 1*1024**2 57 | hits = np.zeros(N) 58 | for i in range(N): 59 | hits[i] = onlyreload() 60 | 61 | miss = np.zeros(N) 62 | for i in range(N): 63 | miss[i] = flushandreload() 64 | 65 | bins = 600 66 | plt.hist(hits[hits < bins], label='hits', bins=bins/10) 67 | plt.hist(miss[miss < bins], label='miss', bins=bins/10) 68 | plt.legend() 69 | plt.show() 70 | -------------------------------------------------------------------------------- /examples/fr_spy.py: -------------------------------------------------------------------------------- 1 | from PyShellCode import ExecutableCode 2 | 3 | import ctypes 4 | import numpy as np 5 | import matplotlib.pyplot as plt 6 | 7 | import mmap 8 | import sys 9 | import os 10 | 11 | if __name__ == '__main__': 12 | 13 | if len(sys.argv) != 2: 14 | print("Usage fr_spy.py binary"); 15 | sys.exit(1) 16 | 17 | statinfo = os.stat(sys.argv[1]) 18 | filesize = statinfo.st_size 19 | print(filesize) 20 | 21 | f = open(sys.argv[1], "rb") 22 | buf = mmap.mmap(f.fileno(), 0, mmap.MAP_SHARED, mmap.PROT_READ) 23 | obj = ctypes.py_object(buf) 24 | address = ctypes.c_void_p() 25 | length = ctypes.c_ssize_t() 26 | ctypes.pythonapi.PyObject_AsReadBuffer(obj, ctypes.byref(address), ctypes.byref(length)) 27 | ptr = address.value 28 | print(ptr) 29 | 30 | flushandreload_nasm_code = """ 31 | mfence 32 | rdtsc 33 | shl rdx, 32 34 | or rax, rdx 35 | mfence 36 | mov rcx, rax ; Save rax 37 | mov rbx, {ptr} 38 | mov rax, [rbx] 39 | mfence 40 | rdtsc 41 | shl rdx, 32 42 | or rax, rdx 43 | mfence 44 | sub rax, rcx 45 | mov rcx, rax 46 | mov rax, {ptr} 47 | clflush [rax] 48 | mov rax, rcx 49 | ret 50 | """ 51 | sched_yield_nasm_code = """ 52 | mov rax, 0x9e 53 | int 0x80 54 | ret 55 | """ 56 | 57 | sched_yield = ExecutableCode.from_NASMCode(sched_yield_nasm_code) 58 | 59 | print("Generating flushandreload instructions: ", filesize / 8) 60 | flushandreloads = [] 61 | for i in range(0, filesize, 8): 62 | if i % 100 == 0: 63 | print(i) 64 | flushandreloads.append(ExecutableCode.from_NASMCode(flushandreload_nasm_code.format(ptr=ptr+i))) 65 | 66 | N = len(flushandreloads) 67 | print("Total test points", N) 68 | 69 | print("Start Monitoring") 70 | M = 20*1024 71 | hits = np.zeros(N) 72 | for j in range(M): 73 | if j % 1000 == 0: 74 | print(j) 75 | for i in range(N): 76 | delta = flushandreloads[i]() 77 | if delta < 160: 78 | hits[i] += 1 79 | sched_yield() 80 | 81 | plt.plot(hits, label='HitsPerAddress') 82 | plt.legend() 83 | plt.show() 84 | -------------------------------------------------------------------------------- /examples/from_file.py: -------------------------------------------------------------------------------- 1 | from PyShellCode import ExecutableCode 2 | import ctypes 3 | import errno 4 | import os 5 | 6 | if __name__ == '__main__': 7 | code = ExecutableCode.from_File(b"examples/example_shellcode_file") 8 | print("Is the generated Executable Code valid?", code.isValid()) 9 | print("Generated Shell Code", code.print()) 10 | print("Run code") 11 | result = code() 12 | print("Return value", result) 13 | -------------------------------------------------------------------------------- /examples/from_nasmcode.py: -------------------------------------------------------------------------------- 1 | from PyShellCode import ExecutableCode 2 | 3 | if __name__ == '__main__': 4 | nasm_code = """ 5 | jmp MESSAGE ; 1) lets jump to MESSAGE 6 | GOBACK: 7 | mov rax, 0x1 8 | mov rdi, 0x1 9 | pop rsi ; 3) we are poping into `rdi`, now we have the 10 | ; address of "Hello, World!" 11 | mov rdx, 0xF 12 | syscall 13 | ret 14 | MESSAGE: 15 | call GOBACK ; 2) we are going back, since we used `call`, that means 16 | ; the return address, which is in this case the address 17 | ; of "Hello, World!", is pushed into the stack. 18 | db "Hello, World!", 0ah, 000, 000 19 | """ 20 | 21 | code = ExecutableCode.from_NASMCode(nasm_code) 22 | print("Is the generated Executable Code valid?", code.isValid()) 23 | print("Generated Shell Code", code.print()) 24 | print("Run code") 25 | result = code() 26 | print("Return value", result) 27 | -------------------------------------------------------------------------------- /examples/from_shellcode.py: -------------------------------------------------------------------------------- 1 | from PyShellCode import ExecutableCode 2 | import ctypes 3 | import errno 4 | import os 5 | 6 | if __name__ == '__main__': 7 | shell_code = b"\xeb\x13\xb8\x01\x00\x00\x00\xbf\x01\x00\x00\x00\x5e\xba\x0f\x00\x00\x00\x0f\x05\xc3\xe8\xe8\xff\xff\xff\x48\x65\x6c\x6c\x6f\x2c\x20\x57\x6f\x72\x6c\x64\x21\x0a" 8 | code = ExecutableCode.from_ShellCode(shell_code) 9 | print("Is the generated Executable Code valid?", code.isValid()) 10 | print("Generated Shell Code", code.print()) 11 | print("Run code") 12 | result = code() 13 | print("Return value", result) 14 | -------------------------------------------------------------------------------- /examples/using_arguments.py: -------------------------------------------------------------------------------- 1 | from PyShellCode import ExecutableCode 2 | 3 | import ctypes 4 | import os 5 | 6 | 7 | if __name__ == '__main__': 8 | text = b'Hallo Welt\n' 9 | data = (ctypes.c_char*len(text))() 10 | data[:] = text 11 | 12 | nasm_code = """ 13 | mov rax, 0x1 ; Parameter 0 -> Syscall Nr 14 | mov rsi, rdi ; Parameter 2 -> buffer is passed as first argument to the function call 15 | mov rdi, 0x1 ; Parameter 1 -> fd 16 | mov rdx, {length}; Parameter 3 -> length 17 | syscall 18 | ret 19 | """.format(length=len(text)) 20 | 21 | code = ExecutableCode.from_NASMCode(nasm_code) 22 | result = code(data) 23 | -------------------------------------------------------------------------------- /include/PyShellCode.h.in: -------------------------------------------------------------------------------- 1 | /* 2 | * Thomas Keck 2017 3 | */ 4 | 5 | #pragma once 6 | 7 | #define PyShellCode_VERSION_MAJOR @PyShellCode_VERSION_MAJOR@ 8 | #define PyShellCode_VERSION_MINOR @PyShellCode_VERSION_MINOR@ 9 | 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | 19 | 20 | struct ExecutableCode { 21 | size_t length; 22 | void *addr; 23 | }; 24 | 25 | 26 | struct ExecutableCode* create_ExecutableCode_from_File(const char *filename); 27 | struct ExecutableCode* create_ExecutableCode_from_ShellCode(const char *shellcode, size_t length); 28 | int valid_ExecutableCode(struct ExecutableCode* code); 29 | int64_t execute_ExecutableCode(struct ExecutableCode* code); 30 | int64_t execute_with_void_ptr_ExecutableCode(struct ExecutableCode* code, void *arguments); 31 | void destroy_ExecutableCode(struct ExecutableCode* code); 32 | void print_ExecutableCode(struct ExecutableCode* code); 33 | 34 | void PrintVersion(void); 35 | -------------------------------------------------------------------------------- /setup.py: -------------------------------------------------------------------------------- 1 | from distutils.core import setup 2 | 3 | setup(name='PyShellCode', 4 | version='1.0', 5 | package_dir={ '': '/home/thomas/pyassembler' }, 6 | packages=['PyShellCode']) 7 | 8 | -------------------------------------------------------------------------------- /setup.py.in: -------------------------------------------------------------------------------- 1 | from distutils.core import setup 2 | 3 | setup(name='PyShellCode', 4 | version='@PyShellCode_VERSION_MAJOR@.@PyShellCode_VERSION_MINOR@', 5 | package_dir={ '': '@CMAKE_CURRENT_SOURCE_DIR@' }, 6 | packages=['PyShellCode']) 7 | 8 | -------------------------------------------------------------------------------- /src/CommandLineArgumentGlue.asm: -------------------------------------------------------------------------------- 1 | ; http://stackoverflow.com/questions/29652446/how-to-change-interpreter-path-and-pass-command-line-arguments-to-an-executable 2 | ; Glue Code which makes command line arguments possible for the main-function in a shared library 3 | ; Specific to 64-bit 4 | 5 | global _main 6 | extern main, _GLOBAL_OFFSET_TABLE_ 7 | 8 | section .text 9 | BITS 64 10 | 11 | _main: 12 | mov rdi, [rsp] ; argc 13 | mov rsi, rsp ; address of argc 14 | add rsi, 8 ; address of argv 15 | call .getGOT 16 | .getGOT: 17 | pop rbx 18 | add rbx,_GLOBAL_OFFSET_TABLE_+$$-.getGOT wrt ..gotpc 19 | jmp main wrt ..plt 20 | -------------------------------------------------------------------------------- /src/PyShellCode.c.in: -------------------------------------------------------------------------------- 1 | /* 2 | * Thomas Keck 2017 3 | */ 4 | 5 | #include "PyShellCode.h" 6 | 7 | struct ExecutableCode* create_ExecutableCode_from_File(const char *filename) { 8 | 9 | struct stat sbuf; 10 | if(stat(filename, &sbuf)) { 11 | perror("Failed to call stat on provided file"); 12 | return NULL; 13 | } 14 | 15 | void *raw_code = NULL; 16 | if(!(raw_code = malloc(sbuf.st_size))) { 17 | perror("Failed to malloc enough memory"); 18 | return NULL; 19 | } 20 | 21 | FILE *fp; 22 | if(!(fp = fopen(filename, "rb"))) { 23 | perror("Failed to open provided file"); 24 | return NULL; 25 | } 26 | 27 | if(fread(raw_code, 1, sbuf.st_size, fp) != (size_t)sbuf.st_size) { 28 | perror("Failed to read provided file"); 29 | return NULL; 30 | } 31 | 32 | if(fclose(fp)) { 33 | perror("Failed to close provided file"); 34 | return NULL; 35 | } 36 | 37 | return create_ExecutableCode_from_ShellCode((char*)raw_code, sbuf.st_size); 38 | } 39 | 40 | 41 | struct ExecutableCode* create_ExecutableCode_from_ShellCode(const char *shellcode, size_t length) { 42 | 43 | struct ExecutableCode *code = malloc(sizeof(struct ExecutableCode)); 44 | code->length = length; 45 | 46 | code->addr = mmap(NULL, code->length, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_SHARED|MAP_ANONYMOUS, -1, 0); 47 | 48 | if(code->addr == MAP_FAILED) { 49 | perror("Memory mapping failed"); 50 | free(code); 51 | return NULL; 52 | } 53 | 54 | // We use memcpy hence \0 bytes in the shellcode won't be a problem. 55 | memcpy(code->addr, shellcode, code->length); 56 | return code; 57 | } 58 | 59 | int valid_ExecutableCode(struct ExecutableCode* code) { 60 | 61 | return code != NULL && code->addr != NULL && code->length > 0; 62 | 63 | } 64 | 65 | int64_t execute_ExecutableCode(struct ExecutableCode* code) { 66 | 67 | if(code == NULL) 68 | return 0; 69 | int64_t result = ((int64_t (*)(void))code->addr)(); 70 | return result; 71 | } 72 | 73 | int64_t execute_with_void_ptr_ExecutableCode(struct ExecutableCode* code, void *arguments) { 74 | 75 | if(code == NULL) 76 | return 0; 77 | int64_t result = ((int64_t (*)(void*))code->addr)(arguments); 78 | return result; 79 | } 80 | 81 | void destroy_ExecutableCode(struct ExecutableCode* code) { 82 | 83 | if(code == NULL) 84 | return; 85 | 86 | if(munmap(code->addr, code->length) == -1) { 87 | perror("Memory un-mapping failed"); 88 | } 89 | 90 | free(code); 91 | } 92 | 93 | void print_ExecutableCode(struct ExecutableCode* code) { 94 | 95 | for(unsigned int i = 0; i < code->length; ++i) { 96 | printf("\\x%02x", ((unsigned char *)code->addr)[i]); 97 | } 98 | printf("\n"); 99 | 100 | } 101 | 102 | void PrintVersion() { 103 | printf("PyShellCode Version: %i.%i", PyShellCode_VERSION_MAJOR, PyShellCode_VERSION_MINOR); 104 | } 105 | 106 | 107 | /** 108 | * Make this shared library executable 109 | */ 110 | const char elf_interpreter[] __attribute__((section(".interp"))) = "@ELF_INTERPRETER_PATH@"; 111 | 112 | 113 | int main(int argc, char *argv[]) { 114 | 115 | if(argc == 0) { 116 | printf("Did not receive any arguments"); 117 | exit(1); 118 | } 119 | 120 | if(argc == 1 || argc > 3) { 121 | printf("Usage %s filename\n", argv[0]); 122 | printf("Usage %s shellcode length\n", argv[0]); 123 | exit(1); 124 | } 125 | 126 | struct ExecutableCode* code = NULL; 127 | 128 | if(argc == 2) { 129 | code = create_ExecutableCode_from_File(argv[1]); 130 | } 131 | 132 | if(argc == 3) { 133 | code = create_ExecutableCode_from_ShellCode(argv[1], atoi(argv[2])); 134 | } 135 | print_ExecutableCode(code); 136 | execute_ExecutableCode(code); 137 | destroy_ExecutableCode(code); 138 | 139 | exit(0); 140 | } 141 | -------------------------------------------------------------------------------- /tools/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | gcc probabilistic_password_checker.c -o probabilistic_password_checker 3 | nasm -f elf64 simple_cache_leak_test.asm -o simple_cache_leak_test.o 4 | ld simple_cache_leak_test.o -o simple_cache_leak_test -s --build-id=none 5 | # gcc simple_cache_leak_test.c -o simple_cache_leak_test -Os -fno-unwind-tables -fno-asynchronous-unwind-tables -s -fno-ident -Wl,--build-id=none 6 | -------------------------------------------------------------------------------- /tools/create_shellcode.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | nasm -f elf64 $1 -o shellcode.o 4 | ld -o shellcode shellcode.o 5 | for i in `objdump -d shellcode | tr '\t' ' ' | tr ' ' '\n' | egrep '^[0-9a-f]{2}$' ` ; do echo -n "\x$i" ; done 6 | echo "" 7 | -------------------------------------------------------------------------------- /tools/flush.asm: -------------------------------------------------------------------------------- 1 | ; Adapted from https://github.com/IAIK/flush_flush/blob/master/sc/cacheutils.h 2 | 3 | global _start 4 | 5 | section .text 6 | 7 | _start: 8 | mov rax, 0xA17400088 9 | mov rbx, 0xA17400088 10 | ;clflush [rbx] 11 | ;clflush [0xA17400088] 12 | ;mov rax, [rbx] 13 | mov rcx, rax 14 | sub rax, rcx 15 | mov rax, rcx 16 | mov rax, 0xF1740008811 17 | -------------------------------------------------------------------------------- /tools/hello_world.asm: -------------------------------------------------------------------------------- 1 | ; Adapted from http://stackoverflow.com/questions/15593214/linux-shellcode-hello-world 2 | ; Exchanged 32bit registers with 64bit (e -> r) 3 | ; Replaced exit syscall 4 | ; mov eax, 0x1 5 | ; mov ebx, 0x0 6 | ; int 0x80 7 | ; with function return (since our shellcode will be called as a function in execute_ExecutableCode) 8 | ; ret 9 | 10 | global _start 11 | 12 | section .text 13 | 14 | _start: 15 | jmp MESSAGE ; 1) lets jump to MESSAGE 16 | GOBACK: 17 | mov rax, 0x4 18 | mov rbx, 0x1 19 | pop rcx ; 3) we are poping into `ecx`, now we have the 20 | ; address of "Hello, World!\n" 21 | mov rdx, 0xF 22 | syscall 23 | ;int 0x80 24 | mov rax, 0x1 25 | mov rbx, 0x0 26 | ;int 0x80 27 | syscall 28 | MESSAGE: 29 | call GOBACK ; 2) we are going back, since we used `call`, that means 30 | ; the return address, which is in this case the address 31 | ; of "Hello, World!\r\n", is pushed into the stack. 32 | db "Hello, World!", 0ah, 000, 000 33 | -------------------------------------------------------------------------------- /tools/mfence.asm: -------------------------------------------------------------------------------- 1 | ; Adapted from https://github.com/IAIK/flush_flush/blob/master/sc/cacheutils.h 2 | 3 | global _start 4 | 5 | section .text 6 | 7 | _start: 8 | nop 9 | mfence 10 | nop 11 | nop 12 | -------------------------------------------------------------------------------- /tools/probabilistic_password_checker.c: -------------------------------------------------------------------------------- 1 | // Adapted from http://shtrom.ssji.net/skb/getc.html 2 | #include 3 | #include 4 | #include 5 | 6 | // Password is aabcccq 7 | static int code[26] = {2,1,3,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0}; 8 | 9 | int main() { 10 | 11 | struct termios old_tio, new_tio; 12 | unsigned char c; 13 | 14 | int counts[26]; 15 | 16 | for(unsigned int i = 0; i < 26; ++i) { 17 | counts[i] = 0; 18 | } 19 | 20 | printf("Probabilistic Password Checker\n"); 21 | printf("This program is very secure, because it's code is stored here: %p", code); 22 | 23 | /* get the terminal settings for stdin */ 24 | tcgetattr(STDIN_FILENO,&old_tio); 25 | 26 | /* we want to keep the old setting to restore them a the end */ 27 | new_tio=old_tio; 28 | 29 | /* disable canonical mode (buffered i/o) and local echo */ 30 | new_tio.c_lflag &=(~ICANON & ~ECHO); 31 | 32 | /* set the new settings immediately */ 33 | tcsetattr(STDIN_FILENO,TCSANOW,&new_tio); 34 | 35 | int already_failed = 0; 36 | do { 37 | c=getchar(); 38 | printf("%d ",c); 39 | if( c >= 'a' && c <= 'z') { 40 | counts[c-'a']++; 41 | // Just to be super secure we test if we exeeded the maximum number of characters 42 | // For sure this makes our application more secure except if someone could monitor 43 | // our access of the code-array. But this is impossible! 44 | if(counts[c-'a'] > code[c-'a']) 45 | already_failed = 1; 46 | } 47 | } while(c!='q'); 48 | 49 | /* restore the former settings */ 50 | tcsetattr(STDIN_FILENO,TCSANOW,&old_tio); 51 | 52 | if(already_failed == 1) { 53 | printf("Password is very wrong!"); 54 | return 1; 55 | } 56 | 57 | for(unsigned int i = 0; i < 26; ++i) { 58 | if(code[i] != counts[i]) { 59 | printf("Password is wrong!"); 60 | return 1; 61 | } 62 | } 63 | 64 | printf("Password was correct! You can continue using my super secure program"); 65 | 66 | return 0; 67 | 68 | } 69 | -------------------------------------------------------------------------------- /tools/rdtsc.asm: -------------------------------------------------------------------------------- 1 | ; Adapted from https://github.com/IAIK/flush_flush/blob/master/sc/cacheutils.h 2 | 3 | global _start 4 | 5 | section .text 6 | 7 | _start: 8 | xor rax, rax 9 | xor rdx, rdx 10 | nop 11 | rdtsc 12 | shl rdx, 32 13 | or rax, rdx 14 | cpuid 15 | rdtscp 16 | shl rdx, 32 17 | or rax, rdx 18 | -------------------------------------------------------------------------------- /tools/simple_cache_leak_test.asm: -------------------------------------------------------------------------------- 1 | SECTION .data 2 | array times 256 dq 0 3 | SECTION .text 4 | global _start 5 | _start: 6 | mov eax, [array+128*8] 7 | add eax, 1 8 | mov [array+128*8], eax 9 | jmp _start 10 | -------------------------------------------------------------------------------- /tools/simple_cache_leak_test.c: -------------------------------------------------------------------------------- 1 | static int array[256]; 2 | 3 | int main() { 4 | 5 | while(1) { 6 | array[128]++; 7 | } 8 | 9 | return array[128]; 10 | 11 | } 12 | --------------------------------------------------------------------------------