maybe_script_execute
maybe_script_execute는 glibc 의 execvp/execvpe 계열 함수 내부에서만 호출되는 헬퍼 함수입니다.
- execve()가 ENOEXEC―즉 “실행 파일 포맷이 아님”―을 돌려주면, glibc는 “혹시 이게 쉘 스크립트가 아닐까?” 하고 마지막 시도로 이 함수를 부릅니다.
- 함수는 새로운 argv를 만들어 **/bin/sh(정확히는 _PATH_BSHELL, 보통 /bin/sh)**로 스크립트를 실행해 보도록 재시도합니다.
- 동작 순서(소스 / 어셈블리 모두 동일):
glibc posix/execvpe.c
- 정체: glibc 내부 전용 함수.
- 목적: “실행 포맷이 아님(ENOEXEC)” 오류가 났을 때, 파일을 쉘 스크립트로 추정하고 /bin/sh로 다시 실행.
- 주요 로직: 인자 개수 계산 → 새 argv 생성 → execve("/bin/sh", new_argv, envp) 호출.
C
pwndbg> disass 0x441aa0
Dump of assembler code for function maybe_script_execute:
0x0000000000441aa0 <+0>: stp x29, x30, [sp, #-48]!
0x0000000000441aa4 <+4>: mov x6, #0x7ffffffe // #2147483646
0x0000000000441aa8 <+8>: mov x29, sp
0x0000000000441aac <+12>: adrp x3, 0x49f000 <tunable_list+2192>
0x0000000000441ab0 <+16>: ldr x3, [x3, #3144]
0x0000000000441ab4 <+20>: stp x19, x20, [sp, #16]
0x0000000000441ab8 <+24>: mov x20, x2
0x0000000000441abc <+28>: stp x21, x22, [sp, #32]
0x0000000000441ac0 <+32>: sub sp, sp, #0x30
0x0000000000441ac4 <+36>: mov x19, sp
0x0000000000441ac8 <+40>: ldr x4, [x1]
0x0000000000441acc <+44>: ldr x5, [x3]
0x0000000000441ad0 <+48>: stur x5, [x29, #-8]
0x0000000000441ad4 <+52>: mov x5, #0x0 // #0
0x0000000000441ad8 <+56>: mov x3, #0x0 // #0
0x0000000000441adc <+60>: cbnz x4, 0x441aec <maybe_script_execute+76>
0x0000000000441ae0 <+64>: b 0x441bec <maybe_script_execute+332>
0x0000000000441ae4 <+68>: cmp x3, x6
0x0000000000441ae8 <+72>: b.eq 0x441bd0 <maybe_script_execute+304> // b.none
0x0000000000441aec <+76>: mov x5, x3
0x0000000000441af0 <+80>: add x3, x3, #0x1
0x0000000000441af4 <+84>: ldr x4, [x1, x3, lsl #3]
0x0000000000441af8 <+88>: cbnz x4, 0x441ae4 <maybe_script_execute+68>
0x0000000000441afc <+92>: lsl x5, x5, #3
0x0000000000441b00 <+96>: add x5, x5, #0x27
0x0000000000441b04 <+100>: and x2, x5, #0xffffffffffff0000
0x0000000000441b08 <+104>: and x5, x5, #0xfffffffffffffff0
0x0000000000441b0c <+108>: sub x2, sp, x2
0x0000000000441b10 <+112>: cmp sp, x2
0x0000000000441b14 <+116>: b.eq 0x441b28 <maybe_script_execute+136> // b.none
0x0000000000441b18 <+120>: sub sp, sp, #0x10, lsl #12
0x0000000000441b1c <+124>: str xzr, [sp, #1024]
0x0000000000441b20 <+128>: cmp sp, x2
0x0000000000441b24 <+132>: b.ne 0x441b18 <maybe_script_execute+120> // b.any
0x0000000000441b28 <+136>: and x5, x5, #0xffff
0x0000000000441b2c <+140>: sub sp, sp, x5
0x0000000000441b30 <+144>: str xzr, [sp]
0x0000000000441b34 <+148>: cmp x5, #0x400
0x0000000000441b38 <+152>: b.cs 0x441bb0 <maybe_script_execute+272> // b.hs, b.nlast
0x0000000000441b3c <+156>: add x21, sp, #0x10
0x0000000000441b40 <+160>: adrp x22, 0x467000 <__aarch64_swp8_acq_rel>
0x0000000000441b44 <+164>: add x2, x22, #0x1c8
0x0000000000441b48 <+168>: stp x2, x0, [x21]
0x0000000000441b4c <+172>: cmp x3, #0x1
0x0000000000441b50 <+176>: b.ne 0x441b9c <maybe_script_execute+252> // b.any
0x0000000000441b54 <+180>: str xzr, [x21, #16]
0x0000000000441b58 <+184>: mov x2, x20
0x0000000000441b5c <+188>: mov x1, x21
0x0000000000441b60 <+192>: add x0, x22, #0x1c8
0x0000000000441b64 <+196>: bl 0x441a80 <execve>
0x0000000000441b68 <+200>: mov sp, x19
0x0000000000441b6c <+204>: adrp x0, 0x49f000 <tunable_list+2192>
0x0000000000441b70 <+208>: ldr x0, [x0, #3144]
0x0000000000441b74 <+212>: ldur x2, [x29, #-8]
0x0000000000441b78 <+216>: ldr x1, [x0]
0x0000000000441b7c <+220>: subs x2, x2, x1
0x0000000000441b80 <+224>: mov x1, #0x0 // #0
0x0000000000441b84 <+228>: b.ne 0x441c00 <maybe_script_execute+352> // b.any
0x0000000000441b88 <+232>: mov sp, x29
0x0000000000441b8c <+236>: ldp x19, x20, [sp, #16]
0x0000000000441b90 <+240>: ldp x21, x22, [sp, #32]
0x0000000000441b94 <+244>: ldp x29, x30, [sp], #48
0x0000000000441b98 <+248>: ret
0x0000000000441b9c <+252>: lsl x2, x3, #3
0x0000000000441ba0 <+256>: add x1, x1, #0x8
0x0000000000441ba4 <+260>: add x0, x21, #0x10
0x0000000000441ba8 <+264>: bl 0x400280
0x0000000000441bac <+268>: b 0x441b58 <maybe_script_execute+184>
0x0000000000441bb0 <+272>: str xzr, [sp, #1024]
0x0000000000441bb4 <+276>: add x21, sp, #0x10
0x0000000000441bb8 <+280>: adrp x22, 0x467000 <__aarch64_swp8_acq_rel>
0x0000000000441bbc <+284>: add x2, x22, #0x1c8
0x0000000000441bc0 <+288>: stp x2, x0, [x21]
0x0000000000441bc4 <+292>: cmp x3, #0x1
0x0000000000441bc8 <+296>: b.eq 0x441b54 <maybe_script_execute+180> // b.none
0x0000000000441bcc <+300>: b 0x441b9c <maybe_script_execute+252>
0x0000000000441bd0 <+304>: movz x0, #0x0, lsl #16
0x0000000000441bd4 <+308>: movk x0, #0x28
0x0000000000441bd8 <+312>: mrs x1, tpidr_el0
0x0000000000441bdc <+316>: mov w2, #0x7 // #7
0x0000000000441be0 <+320>: str w2, [x1, x0]
0x0000000000441be4 <+324>: mov sp, x19
0x0000000000441be8 <+328>: b 0x441b6c <maybe_script_execute+204>
0x0000000000441bec <+332>: adrp x22, 0x467000 <__aarch64_swp8_acq_rel>
0x0000000000441bf0 <+336>: sub x21, x29, #0x20
0x0000000000441bf4 <+340>: add x1, x22, #0x1c8
0x0000000000441bf8 <+344>: stp x1, x0, [x29, #-32]
0x0000000000441bfc <+348>: b 0x441b54 <maybe_script_execute+180>
0x0000000000441c00 <+352>: bl 0x41c8e0 <__stack_chk_fail_local>
End of assembler dump.