ARMv8 Shellcodes from ‘A’ to ‘Z’

We describe a methodology to automatically turn arbitrary ARMv8 programs into alphanumeric executable polymorphic shellcodes. Shellcodes generated in this way can evade detection and bypass filters, broadening the attack surface of ARM-powered devices such as smartphones.

1. 1.

   See http://upx.sf.net.

2. 2.

   Each byte is 8 bits long.

3. 3.

   Which is 01011000001100000011000000110000 in binary. Incidentally, this instruction is alphanumeric and corresponds to the ASCII string 000X. Note the little endianness of the string.

4. 4.

   We used the options -D --architecture aarch64 --target binary.

5. 5.

   Alternatively, we could assume we were working on a Linux OS and perform the appropriate syscall, but again this instruction is not alphanumeric.

6. 6.

   Also know as the ‘effective power’ SMS exploit.

7. 7.

   Apple iOS enforces write xor exec.

Authors and Affiliations

1. École normale supérieure, Computer Science Department, PSL Research University, 75230, Paris Cedex 05, France

   Hadrien Barral, Houda Ferradi, Rémi Géraud, Georges-Axel Jaloyan & David Naccache

Corresponding author

Correspondence to David Naccache .

Editors and Affiliations

1. Huawei International, Singapore, Singapore

   Feng Bao

2. University of Surrey, Guilford, Surrey, United Kingdom

   Liqun Chen

3. Singapore Management University, Singapore, Singapore

   Robert H. Deng

4. Guangzhou University, Guangzhou, Guangdong, China

   Guojun Wang

A Source Code of Program 1

The following Haskell program generates all the possible combinations of 4 alphanumeric characters, and saves the result in a file.

B Alphanumeric Instructions

This appendix describes \(\mathcal A_1\), the set of all AArch64 opcodes that can give alphanumeric instructions for some operands.

• Data processing instructions:

  

• Load and store instructions:

  

• Branch instructions:

  

• Other (SIMD, floating point, crypto...):

  

C Alphanumeric AND

The and operation described in Sect. 4.2 can be automatically generated using the following code. To abstract register numbers and generate repetitive lines, the source code provided is pre-processed by m4 [9]. This allowed us to easily change a register number without changing every occurrence if we found that a specific register could not be used.

D Encoder’s Source Code

We give here the encoder’s full source code. This program is written in PHP.

E Decoder’s Source Code

We give here the decoder’s full source code. This code is pre-processed by m4 [9] which performs macro expansion. The payload program to decode has to be be placed at the pool offset.

F Hello World Shellcode

The following program prints “hello, world” when executed. It can be tested with QEMU using the options qemu-system-aarch64 -machine virt -cpu cortex-a57 -nographic -kernel shellcode.bin -m 2048 --append "cons ole=ttyAMA0". It was generated by the program described in Sect. 5. The notation  means that X is repeated Y times.

G Polymorphic Engine

The following shows two modifications that make the code partly polymorphic. The first one is a modification of the encoder, that will randomize both the payload and the remaining blank space.

The second one is an example of adding polymorphism for zeroing a register using a Haskell engine.

Reprints and permissions

© 2016 Springer International Publishing AG

Policies and ethics