Wrting Shellcode In Emacs
Org babel interface for rasm2
rasm2 comes with the r2 and is used as assembler and disassembler . It support many architecture and provided a simple api . While developing exploit and writing shellcode a tool to assemble instruction is very use full . There are many online tools which provide a interface to assemble instruction but we need a offline solution . We can use rasm2 directly but there is no fun in it . It would be awesome if we can interact with the tool within emacs .
Org mode has a feature called babel , using this feature we can embed code blocks in org files . It is a very power full feature and is used to write literate programs . Since this is emacs we can make it do anything we want .
examining ob-sed.el file which contains all the function used for the execution of
sed source block , yields
(defun org-babel-execute:sed (body params) "Execute a block of sed code with Org Babel. BODY is the source inside a sed source block and PARAMS is an association list over the source block configurations. This function is called by `org-babel-execute-src-block'."
The above function will be called when
org-babel-execute-src-block function is executed over the sed source block , the first argument contains the body of the source block and the second is a association list over the configuration option . The result of this function will be printed on the org file . So we just need to write a function to call rasm2 shell command with correct argument .
(require 'ob) (defconst org-babel-header-args:rasm2 '((:arch . :any) (:bits . :any) (:disasm . :any) ) "Rasm2 specific header arguments.") (defun org-babel-execute:rasm2 (body params) "Execute a block code with Org Babel. BODY is the source inside the source block and PARAMS is an association list over the source block configurations. This function is called by `org-babel-execute-src-block'." (let* ((arch (cdr (assq :arch params))) (bits (cdr (assq :bits params)))) (if (assq :disasm params) (shell-command-to-string (concat "rasm2 -a " arch " -b " (number-to-string bits) " -d \"" body "\"" )) (with-temp-buffer (insert (shell-command-to-string (concat "rasm2 -C -a " arch " -b " (number-to-string bits) " \"" body "\"" ))) (goto-char (point-min)) (while (re-search-forward "\"" nil t ) (replace-match "")) (goto-char (point-min)) (while (re-search-forward "\n" nil t ) (replace-match "")) (buffer-string) ))) )
When rasm2 source block is evaluated this function will be called . Which then parses the configuration option and calls rasm2 with correct argument , the output is return to org file . We have added three header arguments which specifies the architecture , bits and whether to disassemble or not .
#+BEGIN_SRC rasm2 :arch arm :bits 32 add r1,r1,r2 #+END_SRC #+RESULTS: : \x02\x10\x81\xe0 #+BEGIN_SRC rasm2 :arch x86 :bits 32 :disasm 9090 #+END_SRC #+RESULTS: : nop : nop