This program is comptaible with both Python 2 and 3.
It simply returns escaped shell code in Little Endian format for whatever memory address is submitted as the first argument.
It's smart enough to distinguish between addresses with an 0x
prefix and accounts for that.
If the address is only in the 64-bit range, you will only receive the 64-bit output.
If the address can fit in the x86_64 ranges, you will receive both 32 and 64-bit output.
pip3 install lilendian
python setup.py install
./lilendian [single memory address]
$ ./lilendian deadbeef
\xef\xbe\xad\xde
\xef\xbe\xad\xde\x00\x00\x00\x00
$ ./lilendian 0xdeadbeef
\xef\xbe\xad\xde
\xef\xbe\xad\xde\x00\x00\x00\x00
$ ./lilendian 0x00007fffffffd980
\x80\xd9\xff\xff\xff\x7f\x00\x00
Let's say you wanted to get a piece of 64-bit shellcode for 0xdeadbeef + 0xbadcafe + 0xcafebabe + 0xabadbabe
.
for addr in {0xdeadbeef,0xbadcafe,0xcafebabe,0xabadbabe}; do
lilendian $addr | tail -1
done | tr -d "\n"; echo
Output:
\xef\xbe\xad\xde\x00\x00\x00\x00\xfe\xca\xad\x0b\x00\x00\x00\x00\xbe\xba\xfe\xca\x00\x00\x00\x00\xbe\xba\xad\xab\x00\x00\x00\x00
Copy and paste that guy straight into your payload.
(gdb) ! lilendian 0xdeadbeef
\xef\xbe\xad\xde
\xef\xbe\xad\xde\x00\x00\x00\x00
I might tweak it in the future to take multiple memory addresses, but as of right now, it only outputs a single memory address.
I have kept it short and simple to be easily scriptable, so I'll leave the rest up to you.