|
5 | 5 | from unicorn.arm_const import *
|
6 | 6 |
|
7 | 7 | SHELLCODE = (
|
8 |
| - b'\x03\xF0\x8F\xE0', # 0001F894 ADD PC, PC, R3 |
9 |
| - b'\x0D\x07\x21\xF4', # 0001F898 VLD1.8 {D0}, [R1]! |
10 |
| - b'\x0D\x07\x0C\xF4', # 0001F89C VST1.8 {D0}, [R12]! |
11 |
| - b'\x0D\x07\x21\xF4', # 0001F8A0 VLD1.8 {D0}, [R1]! |
12 |
| - b'\x0D\x07\x0C\xF4', # 0001F8A4 VST1.8 {D0}, [R12]! |
13 |
| - b'\x0D\x07\x21\xF4', # 0001F8A8 VLD1.8 {D0}, [R1]! |
14 |
| - b'\x0D\x07\x0C\xF4', # 0001F8AC VST1.8 {D0}, [R12]! |
15 |
| - b'\x0D\x07\x21\xF4', # 0001F8B0 VLD1.8 {D0}, [R1]! |
16 |
| - b'\x0D\x07\x0C\xF4', # 0001F8B4 VST1.8 {D0}, [R12]! |
17 |
| - b'\x0D\x07\x21\xF4', # 0001F8B8 VLD1.8 {D0}, [R1]! |
18 |
| - b'\x0D\x07\x0C\xF4', # 0001F8BC VST1.8 {D0}, [R12]! |
19 |
| - b'\x0D\x07\x21\xF4', # 0001F8C0 VLD1.8 {D0}, [R1]! |
20 |
| - b'\x0D\x07\x0C\xF4', # 0001F8C4 VST1.8 {D0}, [R12]! |
21 |
| - b'\x0D\x07\x21\xF4', # 0001F8C8 VLD1.8 {D0}, [R1]! |
22 |
| - b'\x0D\x07\x0C\xF4', # 0001F8CC VST1.8 {D0}, [R12]! |
23 |
| - b'\x04\x00\x12\xE3', # 0001F8D0 TST R2, #4 |
24 |
| - b'\x04\x30\x91\x14', # 0001F8D4 LDRNE R3, [R1],#4 |
25 |
| - b'\x04\x30\x8C\x14', # 0001F8D8 STRNE R3, [R12],#4 |
26 |
| - b'\x82\x2F\xB0\xE1', # 0001F8DC MOVS R2, R2,LSL#31 |
27 |
| - b'\xB2\x30\xD1\x20', # 0001F8E0 LDRHCS R3, [R1],#2 |
28 |
| - b'\x00\x10\xD1\x15', # 0001F8E4 LDRBNE R1, [R1] |
29 |
| - b'\xB2\x30\xCC\x20', # 0001F8E8 STRHCS R3, [R12],#2 |
30 |
| - b'\x00\x10\xCC\x15', # 0001F8EC STRBNE R1, [R12] |
| 8 | + b'\x03\xF0\x8F\xE0' # 0001F894 ADD PC, PC, R3 |
| 9 | + b'\x0D\x07\x21\xF4' # 0001F898 VLD1.8 {D0}, [R1]! |
| 10 | + b'\x0D\x07\x0C\xF4' # 0001F89C VST1.8 {D0}, [R12]! |
| 11 | + b'\x0D\x07\x21\xF4' # 0001F8A0 VLD1.8 {D0}, [R1]! |
| 12 | + b'\x0D\x07\x0C\xF4' # 0001F8A4 VST1.8 {D0}, [R12]! |
| 13 | + b'\x0D\x07\x21\xF4' # 0001F8A8 VLD1.8 {D0}, [R1]! |
| 14 | + b'\x0D\x07\x0C\xF4' # 0001F8AC VST1.8 {D0}, [R12]! |
| 15 | + b'\x0D\x07\x21\xF4' # 0001F8B0 VLD1.8 {D0}, [R1]! |
| 16 | + b'\x0D\x07\x0C\xF4' # 0001F8B4 VST1.8 {D0}, [R12]! |
| 17 | + b'\x0D\x07\x21\xF4' # 0001F8B8 VLD1.8 {D0}, [R1]! |
| 18 | + b'\x0D\x07\x0C\xF4' # 0001F8BC VST1.8 {D0}, [R12]! |
| 19 | + b'\x0D\x07\x21\xF4' # 0001F8C0 VLD1.8 {D0}, [R1]! |
| 20 | + b'\x0D\x07\x0C\xF4' # 0001F8C4 VST1.8 {D0}, [R12]! |
| 21 | + b'\x0D\x07\x21\xF4' # 0001F8C8 VLD1.8 {D0}, [R1]! |
| 22 | + b'\x0D\x07\x0C\xF4' # 0001F8CC VST1.8 {D0}, [R12]! |
| 23 | + b'\x04\x00\x12\xE3' # 0001F8D0 TST R2, #4 |
| 24 | + b'\x04\x30\x91\x14' # 0001F8D4 LDRNE R3, [R1],#4 |
| 25 | + b'\x04\x30\x8C\x14' # 0001F8D8 STRNE R3, [R12],#4 |
| 26 | + b'\x82\x2F\xB0\xE1' # 0001F8DC MOVS R2, R2,LSL#31 |
| 27 | + b'\xB2\x30\xD1\x20' # 0001F8E0 LDRHCS R3, [R1],#2 |
| 28 | + b'\x00\x10\xD1\x15' # 0001F8E4 LDRBNE R1, [R1] |
| 29 | + b'\xB2\x30\xCC\x20' # 0001F8E8 STRHCS R3, [R12],#2 |
| 30 | + b'\x00\x10\xCC\x15' # 0001F8EC STRBNE R1, [R12] |
31 | 31 | )
|
32 |
| -SHELLCODE = b''.join(SHELLCODE) |
33 | 32 | BASE = 0x1F894
|
34 | 33 | COPY_SRC = 0x1000
|
35 | 34 | COPY_DST = 0x2000
|
|
0 commit comments