https://github.com/stackoverflowexcept1on/shellexec

Executes machine code from a binary file in rwx memory
https://github.com/stackoverflowexcept1on/shellexec

reverse-engineering rust shellcode-loader virtual-memory

Last synced: 2 months ago
JSON representation

Executes machine code from a binary file in rwx memory

• Host: GitHub
• URL: https://github.com/stackoverflowexcept1on/shellexec
• Owner: StackOverflowExcept1on
• Created: 2022-12-16T12:16:36.000Z (about 2 years ago)
• Default Branch: master
• Last Pushed: 2024-09-08T21:28:48.000Z (3 months ago)
• Last Synced: 2024-10-16T07:43:39.297Z (2 months ago)
• Topics: reverse-engineering, rust, shellcode-loader, virtual-memory
• Language: Rust
• Homepage:
• Size: 22.5 KB
• Stars: 1
• Watchers: 2
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
### shellexec

[![Build Status](https://github.com/StackOverflowExcept1on/shellexec/workflows/CI/badge.svg)](https://github.com/StackOverflowExcept1on/shellexec/actions)

[![Latest Version](https://img.shields.io/crates/v/shellexec.svg)](https://crates.io/crates/shellexec)

Cross-platform shellcode executor in rwx memory

```

Usage: shellexec 

Executes shellcode

Positional Arguments:

  binary            path to binary file

Options:

  --help            display usage information

```

### Implementation

[virtual-memory](https://github.com/StackOverflowExcept1on/shellexec/blob/master/virtual-memory/src/lib.rs) is used to execute shellcode.

This helper crates allocates rwx memory using the system functions that is described here:

- Unix

    - [`mmap(NULL, len, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0)`](https://man7.org/linux/man-pages/man2/mmap.2.html)

    - [`munmap(addr, len)`](https://man7.org/linux/man-pages/man2/munmap.2.html)

- Windows

    - [`VirtualAlloc(NULL, len, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)`](https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualalloc)

    - [`VirtualFree(addr, 0, MEM_RELEASE)`](https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualfree)

Then the contents of the file are copied into this memory,

the address of this memory is converted into a function and called

### Installing from [crates.io](https://crates.io/crates/shellexec)

```

cargo install shellexec

```

### Building

```bash

cargo build --release

```

### Usage

```bash

# linux

cargo run --release -- shellexec/test_input/linux

# windows

cargo run --release -- shellexec/test_input/windows

# output

hello from shellcode!

```