»Home
»Examples
»Invocation
»Runtime Library
»Python Bindings
»Known Issues
Shellcode Compiler
A custom shellcode compiler for Binary Ninja

This document describes the runtime environment provided by the Shellcode Compiler. This runtime is a lightweight library that is designed to generate small code, and is embedded into the Shellcode Compiler executable itself for all platforms it supports. The runtime library for the selected platform is automatically included in the compilation, and only the parts that are used by the code are included in the output binary.

Overview

The Shellcode Compiler contains a built-in C runtime containing many of the standard functions typically used in C programs. It also includes helper functions for common shellcoding tasks, such as connecting over TCP/UDP and launching a shell.

Caution No #include directives are needed to access runtime functions. Code that contains #include directives for C runtime functions may fail to compile.

This C runtime may differ in some ways from a typical implementation, in order to reduce code size or to simplify creation of code that can run across many different platforms. Important differences include the handling of error codes, and the use of AF_INET (only allowed for addresses) versus PF_INET (only allowed in socket creation) in socket code.

Caution The variable errno is not available with this runtime. Runtime functions instead return the negation of the error code (i.e. -ENOENT), just like system calls on Linux. Be sure to use the comparison result < 0 rather than result == -1 to check for failure.

Compiler intrinsics

abs, breakpoint, byteswap, end, max, min, next_arg, noreturn, packed, prev_arg, rdtsc, rdtsc_low, rdtsc_high, syscall, syscall2, undefined

File and directory functions

chdir, close, dup, dup2, fchdir, fcntl, fdopen, fgetc, fgets, fprintf, fputc, fputs, fstat, ftruncate, getcwd, getdents, getdirentries, link, lseek, lstat, mkdir, open, pipe, printf, puts, read, readlink, rename, rmdir, select, sendfile, stat, symlink, truncate, unlink, vprintf, vfprintf, write

File security functions

chflags, chmod, chown, fchflags, fchmod, fchown, lchflags, lchown

Hash functions

crc32

Helper functions

bash, create_tcp4_connection, create_tcp6_connection, create_udp4_connection, create_udp6_connection, interactive_bash, interactive_sh, recv_all, redirect_io, send_all, send_string, sh

Memory management functions

alloca, free, malloc, memcpy, memmove, memset, mmap, munmap, shm_open, shm_unlink

Process functions

execl, execve, exit, fork, getpgid, getpgrp, getpid, getppid, kill, setpgid, setsid, sigaction, signal, sysctl, system, tgkill, wait, waitpid

Process security functions

getegid, geteuid, getgid, getgroups, getuid, setegid, seteuid, setgid, setregid, setreuid, setuid

RC4 encryption

rc4_crypt, rc4_init, rc4_output

See the RC4 overview for details on using the RC4 functions.

Socket functions

accept, accept4, bind, connect, getpeername, getsockname, getsockopt, listen, recv, recvfrom, send, sendto, setsockopt, shutdown, socket, socketpair

String manipulation

atoi, snprintf, sprintf, strcat, strchr, strcmp, strcpy, strdup, strlen, strncpy, strrchr, vsprintf, vsnprintf

Time functions

alarm, getitimer, gettimeofday, nanosleep, setitimer, time

Virtual machine functions

quark_exec