38 lines
778 B
ArmAsm
38 lines
778 B
ArmAsm
|
.syntax unified
|
||
|
|
.arm
|
||
|
|
.section .text
|
||
|
|
.global _start
|
||
|
|
.type _start, %function
|
||
|
|
_start:
|
||
|
|
ldr r3, [sp] @ argc
|
||
|
|
add r4, sp, #4 @ argv = &stack[1]
|
||
|
|
add r5, r4, r3, lsl #2 @ envp = argv + argc
|
||
|
|
add r5, r5, #4 @ skip argv terminator
|
||
|
|
|
||
|
|
mov r0, #0
|
||
|
|
mov r1, #0
|
||
|
|
mov r2, #0
|
||
|
|
mov r7, #170 @ setresgid(0, 0, 0)
|
||
|
|
svc #0
|
||
|
|
|
||
|
|
mov r0, #0
|
||
|
|
mov r1, #0
|
||
|
|
mov r2, #0
|
||
|
|
mov r7, #164 @ setresuid(0, 0, 0)
|
||
|
|
svc #0
|
||
|
|
|
||
|
|
adr r0, shell_path
|
||
|
|
mov r1, r4
|
||
|
|
mov r2, r5
|
||
|
|
mov r7, #11 @ execve("/system/bin/sh", argv, envp)
|
||
|
|
svc #0
|
||
|
|
|
||
|
|
mov r0, #127
|
||
|
|
mov r7, #1 @ exit(127)
|
||
|
|
svc #0
|
||
|
|
|
||
|
|
.align 2
|
||
|
|
shell_path:
|
||
|
|
.asciz "/system/bin/sh"
|
||
|
|
.size _start, .-_start
|