Skip to content

Commit c345e1b

Browse files
AndroclastAndroclast
committed
You know having an ARM64 device is mighty convenient
1 parent fe036df commit c345e1b

1 file changed

Lines changed: 16 additions & 14 deletions

File tree

‎Hauyne.Injector/linux/shim/aarch64.zig‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -47,46 +47,48 @@ pub fn emit(
4747
}
4848
// zig fmt: on
4949

50-
// FF 43 00 D1 sub sp, sp, #16 ; handle scratch (no frame pointer)
50+
// 5F 24 03 D5 bti c ; landing pad: pthread enters via blr
51+
// FF 43 00 D1 sub sp, sp, #16 ; frame for saved lr
52+
// FE 03 00 F9 str x30, [sp] ; each blr clobbers lr; preserve caller's
5153
// [imm64 so_path] movz+movk x0, so_path
5254
// 41 00 80 D2 mov x1, #2 ; RTLD_NOW
5355
// [imm64 dlopen] movz+movk x9, dlopen
5456
// 20 01 3F D6 blr x9
55-
// 60 02 00 B4 cbz x0, .done (skip dlsym+call)
56-
// E0 03 00 F9 str x0, [sp]
57-
// E0 03 40 F9 ldr x0, [sp]
57+
// 20 02 00 B4 cbz x0, .done (skip dlsym+call)
5858
// [imm64 symbol] movz+movk x1, "hauyne_start"
5959
// [imm64 dlsym] movz+movk x9, dlsym
60-
// 20 01 3F D6 blr x9
60+
// 20 01 3F D6 blr x9 ; dlsym(handle, symbol); handle already in x0
6161
// E0 00 00 B4 cbz x0, .done
62-
// E9 03 00 AA mov x9, x0
62+
// E9 03 00 AA mov x9, x0 ; save resolved hauyne_start
6363
// [imm64 payload] movz+movk x0, payload_path ; may be 0 fallback to null
6464
// 20 01 3F D6 blr x9
6565
// .done:
66-
// A8 0B 80 D2 mov x8, #93 ; SYS_exit (thread only)
67-
// E0 03 1F AA mov x0, xzr
68-
// 01 00 00 D4 svc #0
66+
// E0 03 1F AA mov x0, xzr ; start_routine returns NULL
67+
// FE 03 40 F9 ldr x30, [sp] ; restore caller's lr
68+
// FF 43 00 91 add sp, sp, #16
69+
// C0 03 5F D6 ret ; back to glibc; detached thread's stack/TCB reaped
6970
// zig fmt: off
7071
{
7172
var o: usize = shim.PayloadShimOff;
73+
page[o] = 0x5F; o += 1; page[o] = 0x24; o += 1; page[o] = 0x03; o += 1; page[o] = 0xD5; o += 1;
7274
page[o] = 0xFF; o += 1; page[o] = 0x43; o += 1; page[o] = 0x00; o += 1; page[o] = 0xD1; o += 1;
75+
page[o] = 0xFE; o += 1; page[o] = 0x03; o += 1; page[o] = 0x00; o += 1; page[o] = 0xF9; o += 1;
7376
writeImm64(page, &o, 0, path_addr);
7477
page[o] = 0x41; o += 1; page[o] = 0x00; o += 1; page[o] = 0x80; o += 1; page[o] = 0xD2; o += 1;
7578
writeImm64(page, &o, 9, @intCast(dlopen_addr));
7679
page[o] = 0x20; o += 1; page[o] = 0x01; o += 1; page[o] = 0x3F; o += 1; page[o] = 0xD6; o += 1;
77-
page[o] = 0x60; o += 1; page[o] = 0x02; o += 1; page[o] = 0x00; o += 1; page[o] = 0xB4; o += 1;
78-
page[o] = 0xE0; o += 1; page[o] = 0x03; o += 1; page[o] = 0x00; o += 1; page[o] = 0xF9; o += 1;
79-
page[o] = 0xE0; o += 1; page[o] = 0x03; o += 1; page[o] = 0x40; o += 1; page[o] = 0xF9; o += 1;
80+
page[o] = 0x20; o += 1; page[o] = 0x02; o += 1; page[o] = 0x00; o += 1; page[o] = 0xB4; o += 1;
8081
writeImm64(page, &o, 1, symbol_addr);
8182
writeImm64(page, &o, 9, @intCast(dlsym_addr));
8283
page[o] = 0x20; o += 1; page[o] = 0x01; o += 1; page[o] = 0x3F; o += 1; page[o] = 0xD6; o += 1;
8384
page[o] = 0xE0; o += 1; page[o] = 0x00; o += 1; page[o] = 0x00; o += 1; page[o] = 0xB4; o += 1;
8485
page[o] = 0xE9; o += 1; page[o] = 0x03; o += 1; page[o] = 0x00; o += 1; page[o] = 0xAA; o += 1;
8586
writeImm64(page, &o, 0, payload_addr);
8687
page[o] = 0x20; o += 1; page[o] = 0x01; o += 1; page[o] = 0x3F; o += 1; page[o] = 0xD6; o += 1;
87-
page[o] = 0xA8; o += 1; page[o] = 0x0B; o += 1; page[o] = 0x80; o += 1; page[o] = 0xD2; o += 1;
8888
page[o] = 0xE0; o += 1; page[o] = 0x03; o += 1; page[o] = 0x1F; o += 1; page[o] = 0xAA; o += 1;
89-
page[o] = 0x01; o += 1; page[o] = 0x00; o += 1; page[o] = 0x00; o += 1; page[o] = 0xD4; o += 1;
89+
page[o] = 0xFE; o += 1; page[o] = 0x03; o += 1; page[o] = 0x40; o += 1; page[o] = 0xF9; o += 1;
90+
page[o] = 0xFF; o += 1; page[o] = 0x43; o += 1; page[o] = 0x00; o += 1; page[o] = 0x91; o += 1;
91+
page[o] = 0xC0; o += 1; page[o] = 0x03; o += 1; page[o] = 0x5F; o += 1; page[o] = 0xD6; o += 1;
9092
}
9193
// zig fmt: on
9294
}

0 commit comments

Comments
 (0)