Gallopsled / Gallopsled/pwntools

ARM XOR encoder not decoding the whole payload

Open
#1,948 0 comments 0 reactions 0 assignees View on GitHub
backport-required bug shellcode
Dominant language
Python
Stars
13.7k
Forks
1.9k
Avg merge
6d 23h
Merged PRs (30d)
3

Description

After manually applying #1923 I noticed that the arm xor encoder is broken for longer payloads.

https://github.com/Gallopsled/pwntools/blob/bd12d1874f17e1fd6a9b26411ccc7ccd6c31f4cb/pwnlib/encoders/arm/xor.py#L29-L46

`maximum` is hardcoded to `256`, so it only decodes `maximum - length` bytes instead of all of `length`.
My quick fix was to set `maximum = len(raw_bytes)*2`, but I'm not sure if that violates some guarantees for the blacklist.

Test:
```python
from pwn import *
context.arch = 'arm'

arm_shellcode = asm(shellcraft.execve('/bin/sh', ['/bin/sh', '-c', 'ls -la'], 0))
arm_shellcode = encoder.encode(arm_shellcode, avoid=b'\x00\n')

exe = ELF.from_bytes(arm_shellcode)
io = process(['/usr/bin/qemu-arm', exe.path])
io.interactive()
```

Contributor guide

Open the contributing guide

Research direction

Start in pwnlib/encoders/arm/xor.py at the linked lines and reproduce the issue with the ARM shellcode and qemu-arm command from the report. Check that longer payloads decode completely while the requested blacklist remains valid; the issue is done when the provided execution test succeeds without truncation.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.