passing and ret params to shellcode

sins/__init__.py

@@ -1,3 +1,3 @@
 #! /usr/bin/env python3
-from .run import example, shell_function
+from .run import example, shell_func
 # from .orm import SeedNode

sins/__main__.py

@@ -1,4 +1,4 @@
 #! /usr/bin/env python3
-from .run import example
+from .run import sins
 
-example()
+sins()

sins/run.py

@@ -10,15 +10,30 @@ import subprocess
 import mmap
 
 whoami_shell = b"\x6a\x3b\x58\x99\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68\x00\x53\x48\x89\xe7\x68\x2d\x63\x00\x00\x48\x89\xe6\x52\xe8\x10\x00\x00\x00\x2f\x75\x73\x72\x2f\x62\x69\x6e\x2f\x77\x68\x6f\x61\x6d\x69\x00\x56\x57\x48\x89\xe6\x0f\x05"
+seed_shell = b'U\x90H\x89\xe5\x90H\x89}\xf8\x90H\x8bE\xf8\x90]\x90\xc3'
 
+def shell_func(shellcode: bytes):
+    exec_mem = mmap.mmap(
+        -1, len(shellcode),
+        prot=mmap.PROT_READ | mmap.PROT_WRITE | mmap.PROT_EXEC,
+        flags=mmap.MAP_ANONYMOUS | mmap.MAP_PRIVATE)
 
-def example():
+    exec_mem.write(shellcode)
+
+    ctypes_buffer = ctypes.c_int.from_buffer(exec_mem)
+    function = ctypes.CFUNCTYPE(ctypes.c_uint, ctypes.c_uint)(
+        ctypes.addressof(ctypes_buffer))
+    function._avoid_gc_for_mmap = exec_mem
+
+    return function
+
+
+def sins():
     now = '{0:%Y%m%dT%H%M%S}'.format(datetime.utcnow())
     parser = ArgumentParser(
         description='position independent code (PIC) mutation experiment.')
     parser.add_argument('-v', '--verbose', action='count')
-    parser.add_argument('-s', '--seed', default='seed',
-                        help='path to PIC image.')
+    parser.add_argument('-s', '--seed', help='path to PIC image.')
     parser.add_argument('-o', '--output', help='path to results directory.')
     args = parser.parse_args()
 
@@ -45,11 +60,25 @@ def example():
         file_handler.setFormatter(log_format)
         logger.addHandler(file_handler)
 
-    logger.info(whoami_shell)
-    shell_function(whoami_shell)()
+    logger.info(now)
+
+    seed_data = seed_shell
+
+    if args.seed:
+        seed = Path(args.seed)
+
+        with seed.open('rb') as seed_file:
+            seed_data = seed_file.read()
 
+    logger.info(f'seed_data\n{seed_data}')
+    logger.info(f'seed_len: {len(seed_data)}')
 
-def shell_function(shellcode: bytes):
+    seed = shell_func(seed_shell)
+    ret_val = seed(ctypes.c_uint(len(seed_data)))
+
+    logger.info(f'ret_val:  {ret_val}')
+
+def func_void(shellcode: bytes):
     exec_mem = mmap.mmap(
         -1, len(shellcode),
         prot=mmap.PROT_READ | mmap.PROT_WRITE | mmap.PROT_EXEC,
@@ -63,3 +92,13 @@ def shell_function(shellcode: bytes):
     function._avoid_gc_for_mmap = exec_mem
 
     return function
+
+
+def example():
+    logging.basicConfig(level=logging.DEBUG)
+    logging.info(whoami_shell)
+    logging.info('wtfm8')
+    whoami = func_void(whoami_shell)
+    ret_val = whoami()
+    # whoami doesn't ret
+    logging.info(ret_val)