Wrting Shellcode In Emacs
Org babel interface for rasm2
rasm2 comes with the r2 and is used as assembler and disassembler . It support many architecture and provided a simple api . While developing exploit and writing shellcode a tool to assemble instruction is very use full . There are many online tools which provide a interface to assemble instruction but we need a offline solution . We can use rasm2 directly but there is no fun in it . It would be awesome if we can interact with the tool within emacs .
Org mode has a feature called babel , using this feature we can embed code blocks in org files . It is a very power full feature and is used to write literate programs . Since this is emacs we can make it do anything we want .
examining ob-sed.el file which contains all the function used for the execution of sed
source block , yields
(defun org-babel-execute:sed (body params)
"Execute a block of sed code with Org Babel.
BODY is the source inside a sed source block and PARAMS is an
association list over the source block configurations. This
function is called by `org-babel-execute-src-block'."
The above function will be called when org-babel-execute-src-block
function is executed over the sed source block , the first argument contains the body of the source block and the second is a association list over the configuration option . The result of this function will be printed on the org file . So we just need to write a function to call rasm2 shell command with correct argument .
(require 'ob)
(defconst org-babel-header-args:rasm2
'((:arch . :any)
(:bits . :any)
(:disasm . :any)
)
"Rasm2 specific header arguments.")
(defun org-babel-execute:rasm2 (body params)
"Execute a block code with Org Babel.
BODY is the source inside the source block and PARAMS is an
association list over the source block configurations. This
function is called by `org-babel-execute-src-block'."
(let* ((arch (cdr (assq :arch params)))
(bits (cdr (assq :bits params))))
(if (assq :disasm params)
(shell-command-to-string
(concat "rasm2 -a " arch " -b " (number-to-string bits) " -d \"" body "\"" ))
(with-temp-buffer
(insert (shell-command-to-string
(concat "rasm2 -C -a " arch " -b " (number-to-string bits) " \"" body "\"" )))
(goto-char (point-min))
(while (re-search-forward "\"" nil t )
(replace-match ""))
(goto-char (point-min))
(while (re-search-forward "\n" nil t )
(replace-match ""))
(buffer-string)
)))
)
When rasm2 source block is evaluated this function will be called . Which then parses the configuration option and calls rasm2 with correct argument , the output is return to org file . We have added three header arguments which specifies the architecture , bits and whether to disassemble or not .
#+BEGIN_SRC rasm2 :arch arm :bits 32
add r1,r1,r2
#+END_SRC
#+RESULTS:
: \x02\x10\x81\xe0
#+BEGIN_SRC rasm2 :arch x86 :bits 32 :disasm
9090
#+END_SRC
#+RESULTS:
: nop
: nop