Passing arguments to shellcode

Applications Programming
1

Is there any way I could pass arguments to shellcode. My goal is to store a program in a image file, and have another program read and run the code with arguments in memory.

Currently I can store a program in a image file, then read it back to the hard-drive run it normally then delete it when it's done running, but I'm worried someone could undelete the program.

---------- Post updated at 08:03 PM ---------- Previous update was at 06:23 PM ----------

Tried the following code, the shellcode prints a string in argc < 2 or prints argv[1] if there is an argument. Code bellow.

unsigned char shellcode[] = 
"\xeb\x0d\x5e\x31\xc9\xb1\x3f\x80\x36\x02\x46\xe2\xfa\xeb\x05\xe8\xee\xff\xff\xff\x57\x8b\xe7\x81\xee\x12\x81\x7f\x0a\x03\x7c\x1e\x89\x47\x0e\x89\x4a\x06\xba\x06\x02\x02\x02\x8b\xc0\x51\xb9\x03\x02\x02\x02\xcf\x82\x59\x33\xc2\xcb\xc1\x64\x92\x8f\x4f\xfe\xba\x06\x02\x02\x02\x8b\xc0\x51\xb9\x03\x02\x02\x02\xcf\x82\x59\x33\xc2\xcb\xc1";

int main(int argc, char *argv[]) 
{
    int (*func)(int, char**) = shellcode;
    (*func) (argc, argv);
}

when compiled it gets an warning,

test.c.tst.c:6:29: warning: initialization from incompatible pointer type

and segfaults when resulting program is run.

shellcode is genorated with shellforge using code bellow.

#include "include/sfsyscall.h"

int main(int argc, char *argv[])
{
    char string[5]="NEA\n";

    if ( argc < 2 )
    {
        write(1,string,sizeof(string));
    }else{
        write(1,argv[1], sizeof(argv[1]));
    }

    return(0);
}
2

Well, what is it?

Why are you doing this?

Ah, so it's an entire executable file? An executable file is not a function. That won't work. Why are you concerned about people undeleting the executables you're hiding in an image file, and not about them undeleting the image file?

How did you write this? I have no idea if you should expect this to work or not even if the segment the data in was executable. You need to create an executable segment with mmap(), copy the data in, and run it from there, but beyond that I can't help you.

3

Reading about mmap now.
As for why I'm doing it, sort of a hobbie, write lots of ciphers and file hiding programs, thought I'd write one that can hide the resulting programs. Create a big maze of ciphered and hidden files and get my friends to try and find and decode them.

4

Could you answer the rest of my questions? I still can't help you without more information.

5

Going to use ramdisks to store the programs. Haven't worked with shellcode in ages, and thought it was easier to convert c to shellcode.

Thanks for your help

6 
#include "include/sfsyscall.h"

int main(int argc, char *argv[])
{
    char string[5]="NEA\n";

    if ( argc < 2 )
    {
        write(1,string,sizeof(string));
    }else{
        write(1,argv[1], sizeof(argv[1]));
    }

    return(0);
}

This doesn't use shellforge at all. It write()'s the raw strings from argv to standard output. That's what had me so puzzled: There's some very important steps missing between this and even the nonfunctional example you posted.

sizeof() doesn't work on strings either since sizeof() is fixed at compile-time while strings can vary at runtime. It only gives you the size of the pointer pointing to the string. strlen() would be what you want.