Description: Baby’s first second problem, welcome to a beautiful risc architecture called MIPS.
This challenge is absolutely the same as tyro_shellcode1 but compiled for MIPS architecture.
This time around I will do read/write syscalls with static buffer address located in the .bss section.
Sorry about not writing MIPS assembly but it appears I haven’t compiled pwntools/binutils with mips support. Instead I had to manually use rasm2 as assembler/disassembler.
The disassembly of the shellcode can be achieved with rasm2 -a mips -b 32 -e -d '24020fa3'…:
The assembly is just as simple rasm2 -a mips -b 32 -e 'addiu v0, zero,4003'.
Few things to pay attention to:
MIPS is big endien
Rasm2 assemble syntax takes different syntax from what u see in IDA. Most of the time it will be 3 operands. So addiu v0, zero, 0xfa3 == li v0, 0xfa3 but the second syntax won’t assemble for whatever reason :(.
Syscall number goes in v0
Arguments go in a0, a1, a2….
lui a1, 0x4a moves 0x4a in the high order 2 bytes of 32bit register a1
ori a1, a1, 0x5cd0 does a logical OR of low order 2 bytes of a1 with 0x5cd0