@@ -14,90 +14,48 @@ Any of the arguments can be expressions to be evaluated by :func:`pwnlib.constan
14
14
Example:
15
15
16
16
>>> print(pwnlib.shellcraft.loong64.linux. syscall ( 'SYS_execve' , 1 , 'sp' , 2 , 0 ).rstrip())
17
- /* call execve(1, 'sp', 2, 0) */
18
- c.li a0 , 1
19
- c.mv a1 , sp
20
- c.li a2 , 2
21
- c.li a3 , 0
22
- /* mv a7, 0xdd */
23
- xori a7 , zero, 0x722
24
- xori a7 , a7 , 0x7ff
25
- ecall
17
+ addi.d $ a0 , $ r0 , 1
18
+ addi.d $ a1 , $ sp , 0
19
+ addi.d $ a2 , $ r0 , 2
20
+ addi.d $ a3 , $ r0 , 0
21
+ addi.d $ a7 , $ r0 , 221
22
+ syscall
26
23
>>> print(pwnlib.shellcraft.loong64.linux. syscall ( 'SYS_execve' , 2 , 1 , 0 , 20 ).rstrip())
27
- /* call execve(2, 1, 0, 0x14) */
28
- c.li a0 , 2
29
- c.li a1 , 1
30
- c.li a2 , 0
31
- c.li a3 , 0x14
32
- /* mv a7, 0xdd */
33
- xori a7 , zero, 0x722
34
- xori a7 , a7 , 0x7ff
35
- ecall
24
+ addi.d $ a0 , $ r0 , 2
25
+ addi.d $ a1 , $ r0 , 1
26
+ addi.d $ a2 , $ r0 , 0
27
+ addi.d $ a3 , $ r0 , 20
28
+ addi.d $ a7 , $ r0 , 221
29
+ syscall
36
30
>>> print(pwnlib.shellcraft.loong64.linux. syscall ().rstrip())
37
- /* call syscall() */
38
- ecall
31
+ syscall
39
32
>>> print(pwnlib.shellcraft.loong64.linux. syscall ( 'a7' , 'a0' , 'a1' ).rstrip())
40
- /* call syscall('a7', 'a0', 'a1') */
41
- /* setregs noop */
42
- ecall
33
+ syscall
43
34
>>> print(pwnlib.shellcraft.loong64.linux. syscall ( 'a3' , None , None , 1 ).rstrip())
44
- /* call syscall('a3', ?, ?, 1) */
45
- c.li a2 , 1
46
- c.mv a7 , a3
47
- ecall
35
+ addi.d $ a2 , $ r0 , 1
36
+ addi.d $ a7 , $ a3 , 0
37
+ syscall
48
38
>>> print(pwnlib.shellcraft.loong64.linux. syscall (
49
39
... 'SYS_mmap' , 0 , 0x1000 ,
50
40
... 'PROT_READ | PROT_WRITE | PROT_EXEC' ,
51
41
... 'MAP_PRIVATE' ,
52
42
... - 1 , 0 ).rstrip())
53
- /* call mmap(0, 0x1000, 'PROT_READ | PROT_WRITE | PROT_EXEC', 'MAP_PRIVATE', -1, 0) */
54
- c.li a0 , 0
55
- c.lui a1 , 1 /* mv a1, 0x1000 */
56
- c.li a2 , 7
57
- c.li a3 , 2
58
- c.li a4 , 0xffffffffffffffff
59
- c.li a5 , 0
60
- /* mv a7, 0xde */
61
- xori a7 , zero, 0x721
62
- xori a7 , a7 , 0x7ff
63
- ecall
64
- >>> print(pwnlib.shellcraft.openat('AT_FDCWD', '/home/pwn/flag').rstrip())
65
- /* openat(fd='AT_FDCWD', file='/home/pwn/flag', oflag=0) */
66
- /* push b'/home/pwn/flag\x00' */
67
- li t4, 0x77702f656d6f682f
68
- sd t4, -16 (sp )
69
- li t4, 0x67616c662f6e
70
- sd t4, -8 (sp )
71
- addi sp , sp , -16
72
- c.mv a1 , sp
73
- xori a0 , zero, 0xffffffffffffff9c
74
- c.li a2 , 0
75
- /* call openat() */
76
- /* mv a7, 0x38 */
77
- xori a7 , zero, 0x7c7
78
- xori a7 , a7 , 0x7ff
79
- ecall
43
+ addi.d $ a0 , $ r0 , 0
44
+ addi.d $ a1 , $ r0 , 1
45
+ lu52i.d $ a1 , $ a1 , 0
46
+ addi.d $ a2 , $ r0 , 7
47
+ addi.d $ a3 , $ r0 , 2
48
+ addi.d $ a4 , $ r0 , 15
49
+ lu52i.d $ a4 , $ a4 , - 1
50
+ lu52i.d $ a4 , $ a4 , - 1
51
+ lu52i.d $ a4 , $ a4 , - 1
52
+ lu52i.d $ a4 , $ a4 , - 1
53
+ lu52i.d $ a4 , $ a4 , - 1
54
+ addi.d $ a5 , $ r0 , 0
55
+ addi.d $ a7 , $ r0 , 222
56
+ syscall
80
57
</%docstring>
81
58
<%
82
- if isinstance(syscall, (str, text_type, Constant)) and str(syscall).startswith('SYS_'):
83
- syscall_repr = str(syscall)[4 :] + "(%s)"
84
- args = []
85
- else:
86
- syscall_repr = 'syscall(%s)'
87
- if syscall is None:
88
- args = ['?' ]
89
- else:
90
- args = [pretty(syscall, False)]
91
-
92
- for arg in [arg0, arg1, arg2, arg3, arg4, arg5]:
93
- if arg is None:
94
- args.append('?' )
95
- else:
96
- args.append(pretty(arg, False))
97
- while args and args[-1 ] == '?' :
98
- args.pop()
99
- syscall_repr = syscall_repr % ', '.join(args)
100
-
101
59
registers = abi.register_arguments
102
60
arguments = [ syscall , arg0 , arg1 , arg2 , arg3 , arg4 , arg5 ]
103
61
regctx = dict(zip(registers , arguments))
0 commit comments