support shellcode offset

Author: b1tg

Cargo.lock

@@ -8,3 +8,4 @@ edition = "2018"
 
 [dependencies]
 bindings = { package = "rs_shellcode_bindings", path = "bindings" }
+clap = "3.0.0-beta.2"

Cargo.toml

@@ -23,16 +23,40 @@ Build:
 cargo build
 ```
 
+Usage:
+```
+rs_shellcode 
+
+USAGE:
+    rs_shellcode.exe [FLAGS] [OPTIONS] -f <file>
+
+FLAGS:
+    -b               set breakpoint in debugger
+    -h, --help       Prints help information
+    -V, --version    Prints version information
+
+OPTIONS:
+    -f <file>          shellcode path
+    -o <offset>        shellcode offset
+```
+
 Run:
 
 ```sh
-./target/debug/rs_shellcode.exe <SHELLCODE_PATH>
+./target/debug/rs_shellcode.exe -f <SHELLCODE_PATH>
 ```
 
+When your shellcode not start at offset 0, you can specify the offset use `-o`:
+
+```sh
+./target/debug/rs_shellcode.exe -f <SHELLCODE_PATH> -o 0x30
+```
+
+
 Run with breakpoint flag (`-b`):
 
 ```sh
-./target/debug/rs_shellcode.exe <SHELLCODE_PATH> -b
+./target/debug/rs_shellcode.exe -f <SHELLCODE_PATH> -b
 ```
 
 use this flag, you can break just before your shellcode in the debugger, which will make your life easier.

README.md

@@ -1,47 +1,81 @@
 #![feature(asm)]
+#![feature(pattern)]
+
 // #![windows_subsystem = "windows"]
 use bindings::windows::win32::system_services::VirtualAlloc;
+use clap::{App, Arg};
 pub const PAGE_EXECUTE_READWRITE: u32 = 0x40;
 pub const MEM_COMMIT: u32 = 0x1000;
 pub const MEM_RESERVE: u32 = 0x2000;
 
 fn main() {
-    let args: Vec<String> = std::env::args().collect();
-    if args.len() < 2 {
-        println!("Usage: ./rs_shellcode \"C:\\Users\\Admin\\Desktop\\calc64.raw\" [-b]");
-        return;
-    }
-    let mut set_breakpoint = false;
-    if args.len() == 3 {
-        set_breakpoint = &args[2] == "-b";
-        println!("[*] Set breakpoint in debugger");
+    let matches = App::new("rs_shellcode")
+        .arg(
+            Arg::new("file")
+                .short('f')
+                .about("shellcode path")
+                .takes_value(true)
+                .required(true),
+        )
+        .arg(
+            Arg::new("breakpoint")
+                .short('b')
+                .about("set breakpoint in debugger"),
+        )
+        .arg(
+            Arg::new("offset")
+                .short('o')
+                .about("shellcode offset")
+                .takes_value(true),
+        )
+        .get_matches();
+
+    let set_breakpoint = matches.is_present("breakpoint");
+    if set_breakpoint {
+        println!("[*] Breakpoint flag set!");
     }
-    let fp = &args[1];
-    // let fp = "C:\\Users\\Admin\\Desktop\\calc64.raw".to_owned();
+    let fp: String = matches.value_of_t("file").unwrap_or_else(|e| e.exit());
+    let offset: u64 = match matches.value_of("offset") {
+        Some(offset) => {
+            if offset.find("0x") == Some(0) {
+                let without_prefix = offset.trim_start_matches("0x");
+                u64::from_str_radix(without_prefix, 16).unwrap_or(0)
+            } else {
+                u64::from_str_radix(offset, 10).unwrap_or(0)
+            }
+        }
+        _ => 0,
+    };
     println!("[*] Reading shellcode from path: {:?}", fp.clone());
     let contents = std::fs::read(fp).unwrap();
     let flen = contents.len();
 
-    let test_buf = unsafe {
+    if flen as u64 <= offset {
+        println!(
+            "[*] Offset too big, offset: {}, file length: {}",
+            offset, flen
+        );
+        return;
+    }
+    let new_buf = unsafe {
         VirtualAlloc(
             std::ptr::null_mut(),
             flen,
             MEM_COMMIT | MEM_RESERVE,
             PAGE_EXECUTE_READWRITE,
         )
     };
-    if test_buf == std::ptr::null_mut() {
+    if new_buf == std::ptr::null_mut() {
         println!("[*] Failed to allocate memory");
         return;
     }
-    let test_buf_ptr: *mut u8 = test_buf as *mut u8 as _;
-    unsafe { std::ptr::copy_nonoverlapping(contents.as_ptr(), test_buf_ptr, flen) };
-    println!("[*] Before jmp to shellcode");
-
+    let new_buf_ptr: *mut u8 = new_buf as *mut u8 as _;
+    unsafe { std::ptr::copy_nonoverlapping(contents.as_ptr(), new_buf_ptr, flen) };
+    println!("[*] Starting jmp to shellcode at offset 0x{:x}", offset);
     unsafe {
         if set_breakpoint {
             asm!("int 3");
         }
-        asm!("jmp {}",in(reg) test_buf)
+        asm!("jmp {}",in(reg) new_buf.offset(offset as isize))
     };
 }