Gallopsled / Gallopsled/pwntools
ARM XOR encoder not decoding the whole payload
- Dominant language
- Python
- Stars
- 13.7k
- Forks
- 1.9k
- Avg merge
- 6d 23h
- Merged PRs (30d)
- 3
Description
After manually applying #1923 I noticed that the arm xor encoder is broken for longer payloads.
https://github.com/Gallopsled/pwntools/blob/bd12d1874f17e1fd6a9b26411ccc7ccd6c31f4cb/pwnlib/encoders/arm/xor.py#L29-L46
`maximum` is hardcoded to `256`, so it only decodes `maximum - length` bytes instead of all of `length`.
My quick fix was to set `maximum = len(raw_bytes)*2`, but I'm not sure if that violates some guarantees for the blacklist.
Test:
```python
from pwn import *
context.arch = 'arm'
arm_shellcode = asm(shellcraft.execve('/bin/sh', ['/bin/sh', '-c', 'ls -la'], 0))
arm_shellcode = encoder.encode(arm_shellcode, avoid=b'\x00\n')
exe = ELF.from_bytes(arm_shellcode)
io = process(['/usr/bin/qemu-arm', exe.path])
io.interactive()
```
Contributor guide
Research direction
Start in pwnlib/encoders/arm/xor.py at the linked lines and reproduce the issue with the ARM shellcode and qemu-arm command from the report. Check that longer payloads decode completely while the requested blacklist remains valid; the issue is done when the provided execution test succeeds without truncation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100