Questions about this topic? Sign up to ask in the talk tab.

Difference between revisions of "Shellcode/Environment"

From NetSec
Jump to: navigation, search
Line 1: Line 1:
 +
{{info|<center>The code and ideas discussed here are part of an [[shellcode|all-encompassing shellcode article]]. Everything described here and the full source of any given code is available in [[Shellcode/Appendix#Loaders|the appendix]], as well as in the downloadable [[shellcodecs]] package.</center>}}
 +
 
== x86/x64 GetCPU (any OS) ==
 
== x86/x64 GetCPU (any OS) ==
  

Revision as of 02:38, 25 November 2012

c3el4.png
The code and ideas discussed here are part of an all-encompassing shellcode article. Everything described here and the full source of any given code is available in the appendix, as well as in the downloadable shellcodecs package.

x86/x64 GetCPU (any OS)

Architecture can only be determined when compatible channels between the target instruction set architectures can be isolated. As long as the instructions perform valid behavior and do not cause access faults on operating systems native to the architecture, it is possible to use a single bytecode sequence in order to determine architecture across a variety of processors. It takes a high amount of familiarity and experience with two or more given instruction sets to write shellcode for multiple architectures.

x64 does not vastly differ from x86 because AMD stepped in to correct intel's calling convention and architecture.

Instruction Comparison

This chart was derived by cross referencing available alphanumeric 64 bit instructions with available printable 32 bit instructions.

Intercompatible x86* Alphanumeric Opcodes
Hex ASCII Assembler Instruction
0x64, 0x65 d,e [fs | gs] prefix
0x66, 0x67 f,g 16bit [operand | ptr] override
0x68, 0x6a h,j push
0x69, 0x6b i,k imul
0x6c-0x6f l-o ins[bwd], outs[bwd]
0x70-0x7a p-z Conditional Jumps
0x30-0x35 0-5 xor
0x36 6  %ss segment register
0x38-0x39 8,9 cmp
0x50-0x57 P-W push *x, *i, *p
0x58-0x5a XYZ pop [*ax, *cx, *dx]


Inter-compatibility theory

The opcodes which are specifically not compatible are limited to the 32 and 64 bit opcodes 0x40-0x4f, which allow a 32 bit processor to increment or decrement its general-purpose registers, but become prefixes for manipulation of 64 bit registers and 8 additional 64 bit general purpose registers in x64 environments, %r8-%r15.

Because not all opcodes are intercompatible, yet comparisons and conditional jumps are intercompatible, it is possible to determine the architecture of an x86 processor using exclusively alphanumeric opcodes.

By making use of these additional registers (which 32 bit processors do not have), one can perform an operation that will set a value on a different register in the two processors.

Following this, a conditional statement can be made against one of the two registers to determine if the value was set.

Using the pop instruction is the most effective way to set the value of a register due to instructional limitations (to keep the code alphanumeric). Using an alternative register to %rsp or %esp as a placeholder for the stack pointer enables the use of an effective conditional statement to determine if the value of a register is equal to the most recent thing pushed or popped from the stack.

Practically Applied: Code

This simple alphanumeric bytecode is 15 bytes long, ending in a comparison which returns equal on a 32 bit system and not equal on a 64 bit system.

When implementing this bytecode, a conditional jump afterwards may be best reserved for the t and u instructions, jump if equal and jump if not equal, respectively.

  • Assembled:
TX4HPZTAZAYVH92
  • Disassembly:
OpCodes x86 x64
54
push %esp
push %rsp
58
pop %eax
pop %rax
34 48
xor $0x48, %al
xor $0x48, %al
50
push %eax
push %rax
5a
pop %edx
pop %rdx
54
push %esp
push %rsp
41
5a
inc %ecx
pop %edx
pop %r10
41
59
inc %ecx
pop %ecx
pop %r9
56
push %esi
push %rsi
48
39 32
dec %eax
cmp %esi,(%edx)
cmp %rsi,(%rdx)

This code executes similarly on both a 32-bit and 64-bit system - similarly, but not identically. The key discrepancy between how the two architectures execute this code is contained in the opcodes "0x41 - 0x4f".

Under a 32-bit architecture, this code pops the value of esp (which was pushed onto the stack previously) into edx and increments ecx. The esp register is a pointer to the top of the stack, so now rdx contains a pointer to the top of the stack. After this is done, the shellcode goes on to push esi onto the stack - so the value of esi now resides at the top of the stack. When the code executes its final comparison - "cmp %esi, (%edx)" - it is comparing the value of esi to the value that edx points to. As edx points to the top of the stack, and as we have just pushed esi onto the top of the stack, we are comparing the value of esi with the value of esi. For this reason, it returns equal.

This shellcode is not equal under a 64-bit architecture, however. The opcodes "41 5a 41 59" have a different function - instead of popping the value of esp into rdx, it instead pops it into the 64-bit register %r10 without incrementing %ecx or %rcx, as 0x41 is used as a prefix to indicate the access to the 64-bit architecture. As a result, when the final comparison is made between rsi and the value referenced by rdx, it returns not equal, as rdx does not point to the top of the stack.

On a 64-bit system, this will not cause a segfault because (%rdx) points to somewhere inside the stack.

GetPc

The Getpc technique is any technique implementing code which obtains the current instruction pointer. This can be useful when writing polymorphic shellcode, or other code that must become aware of its environment because environment information cannot be supplied prior to execution of the code.

x86 (32 bit)

 
jmp startup
getpc:
   mov (%esp), %eax
   ret
startup:
call getpc       ; the %eax register now contains %eip on the next line 
 

x64

 
jmp startup
getpc:
   mov (%rsp), %rax
   ret
startup:
call getpc       ; the %rax register now contains %rip on the next line