did anyone have a go yet at alphanumeric shellcode for ?

it doesn't look very promising (no memory store instructions !):

although there are some instructions to get values into registers, and some to make jumps, that leaves no way

- to do a system call directly—needs 0x73 and 0x00
- to write a 'ecall' instruction on the stack to jump to

approaches that might work, are:

- if an existing offset of an ecall instruction is known it can jump there!
- in a similar way, if it knows the offset of a memory write+ret, it could use that

this goes into ROP territory, this means that it can never be self-contained :)

Sign in to participate in the conversation
unidentified instance

(instance image by мøтħer ¢røω)