did anyone have a go yet at alphanumeric shellcode for #riscv?
it doesn't look very promising (no memory store instructions !):
although there are some instructions to get values into registers, and some to make jumps, that leaves no way
- to do a system call directly—needs 0x73 and 0x00
- to write a 'ecall' instruction on the stack to jump to
approaches that might work, are:
- if an existing offset of an ecall instruction is known it can jump there!
- in a similar way, if it knows the offset of a memory write+ret, it could use that
this goes into ROP territory, this means that it can never be self-contained :)