Package: shelf-loader
Shelf LoaderThis library is used to loadShelf shellcodesInstallpip3installshelf_loaderRun shelf shellcode:python3-mshelf_loader./my_shellcode.outErrorsOn errors the loader will try to resolve and disassemble the faulting address.
To do so it needs the source elf binary as argumentExample of an error# This will cause error because the compiled example doesn't support no-rwx-memorypython3-mshelf_loader../outputs/arm32_elf_features.out.shellcode--no-rwx--source-elf../outputs/arm32_elf_features.outOutput:qemu-arm-static/mnt/repos/binary_relocations/shellcode_loader/shelf_loader/shelf_loader/resources/shellcode_loader_no_rwx_arm32.out../outputs/arm32_elf_features.out.shellcode
Loading../outputs/arm32_elf_features.out.shellcode
Shellcodesize=511472Allocatingshellcodebuffer,size=512000Mappingnewmemory,size=512000Jumpingtoshellcode,address=0xff6f4000info->si_addr=0xff76f00c
Faultingaddress:0xff6f44040xff6f43c4:ldrr3,[r3,#4]                # 0x4 0x30 0x93 0xe50xff6f43c8:cmpr3,#3                      # 0x3 0x0 0x53 0xe30xff6f43cc:bne#0xff6f43f4                 # 0x8 0x0 0x0 0x1a0xff6f43d0:ldrr3,[fp,#-0x14]            # 0x14 0x30 0x1b 0xe50xff6f43d4:ldrr2,[r3]# 0x0 0x20 0x93 0xe50xff6f43d8:ldrr3,[fp,#-0x2c]            # 0x2c 0x30 0x1b 0xe50xff6f43dc:ldrr3,[r3]# 0x0 0x30 0x93 0xe50xff6f43e0:addr3,r2,r3# 0x3 0x30 0x82 0xe00xff6f43e4:strr3,[fp,#-0x24]            # 0x24 0x30 0xb 0xe50xff6f43e8:ldrr3,[fp,#-0x24]            # 0x24 0x30 0x1b 0xe50xff6f43ec:strr3,[fp,#-0x18]            # 0x18 0x30 0xb 0xe50xff6f43f0:b#0xff6f43fc                   # 0x1 0x0 0x0 0xea0xff6f43f4:movr3,#8                      # 0x8 0x30 0xa0 0xe30xff6f43f8:b#0xff6f4460                   # 0x18 0x0 0x0 0xea0xff6f43fc:ldrr3,[fp,#-0x14]            # 0x14 0x30 0x1b 0xe50xff6f4400:ldrr2,[fp,#-0x18]            # 0x18 0x20 0x1b 0xe5MLOADER:loader_handle_relocation_table---->0xff6f4404:strr2,[r3]# 0x0 0x20 0x83 0xe50xff6f4408:ldrr3,[fp,#-8]               # 0x8 0x30 0x1b 0xe50xff6f440c:addr3,r3,#0xc                # 0xc 0x30 0x83 0xe20xff6f4410:strr3,[fp,#-8]               # 0x8 0x30 0xb 0xe50xff6f4414:ldrr3,[fp,#-0x10]            # 0x10 0x30 0x1b 0xe50xff6f4418:cmpr3,#0                      # 0x0 0x0 0x53 0xe30xff6f441c:beq#0xff6f442c                 # 0x2 0x0 0x0 0xa0xff6f4420:ldrr3,[fp,#-0xc]             # 0xc 0x30 0x1b 0xe50xff6f4424:subr3,r3,#1                  # 0x1 0x30 0x43 0xe20xff6f4428:strr3,[fp,#-0xc]             # 0xc 0x30 0xb 0xe50xff6f442c:ldrr3,[fp,#-0x28]            # 0x28 0x30 0x1b 0xe50xff6f4430:ldrr3,[r3,#0xc]              # 0xc 0x30 0x93 0xe50xff6f4434:ldrr2,[fp,#-8]               # 0x8 0x20 0x1b 0xe50xff6f4438:cmpr2,r3# 0x3 0x0 0x52 0xe1Debugging with the loaderby adding the following to the command line--attach-debuggeryou will be prompted into the loader interactive disassembler
from there you can fork into gdb using the gdb command.
inside gdb many specific commands are definedCommands inside gdbDisassm commandThe disassm command use gdb to disassemble the code where pc is pointed to.
it will also try to resolve symbols inside the shellcode and display them beside the disassembly output/execute_shellcodebreak on shellcode entry pointbreak_on_shellcode_mainbreak on shellcode main function it does this by locating the address of the shellcode main function.