»Home
»Examples
»Invocation
»Runtime Library
»Python Bindings
»Known Issues
Shellcode Compiler
A custom shellcode compiler for Binary Ninja

# Shellcode Compiler Runtime

This document describes the runtime environment provided by the Shellcode Compiler. This runtime is a lightweight library that is designed to generate small code, and is embedded into the Shellcode Compiler executable itself for all platforms it supports. The runtime library for the selected platform is automatically included in the compilation, and only the parts that are used by the code are included in the output binary.

## Overview

The Shellcode Compiler contains a built-in C runtime containing many of the standard functions typically used in C programs. It also includes helper functions for common shellcoding tasks, such as connecting over TCP/UDP and launching a shell.

| No #include directives are needed to access runtime functions. Code that contains #include directives for C runtime functions may fail to compile.

This C runtime may differ in some ways from a typical implementation, in order to reduce code size or to simplify creation of code that can run across many different platforms. Important differences include the handling of error codes, and the use of AF_INET (only allowed for addresses) versus PF_INET (only allowed in socket creation) in socket code.

| The variable errno is not available with this runtime. Runtime functions instead return the negation of the error code (i.e. -ENOENT), just like system calls on Linux. Be sure to use the comparison result < 0 rather than result == -1 to check for failure.

## Compiler intrinsics

abs, breakpoint, byteswap, end, max, min, next_arg, noreturn, packed, prev_arg, rdtsc, rdtsc_low, rdtsc_high, syscall, syscall2, undefined

## File and directory functions

chdir, close, dup, dup2, fchdir, fcntl, fdopen, fgetc, fgets, fprintf, fputc, fputs, fstat, ftruncate, getcwd, getdents, getdirentries, link, lseek, lstat, mkdir, open, pipe, printf, puts, read, readlink, rename, rmdir, select, sendfile, stat, symlink, truncate, unlink, vprintf, vfprintf, write

## File security functions

chflags, chmod, chown, fchflags, fchmod, fchown, lchflags, lchown

## Hash functions

crc32

## Helper functions

bash, create_tcp4_connection, create_tcp6_connection, create_udp4_connection, create_udp6_connection, interactive_bash, interactive_sh, recv_all, redirect_io, send_all, send_string, sh

## Memory management functions

alloca, free, malloc, memcpy, memmove, memset, mmap, munmap, shm_open, shm_unlink

## Process functions

execl, execve, exit, fork, getpgid, getpgrp, getpid, getppid, kill, setpgid, setsid, sigaction, signal, sysctl, system, tgkill, wait, waitpid

## Process security functions

getegid, geteuid, getgid, getgroups, getuid, setegid, seteuid, setgid, setregid, setreuid, setuid

## RC4 encryption

rc4_crypt, rc4_init, rc4_output

See the RC4 overview for details on using the RC4 functions.

## Socket functions

accept, accept4, bind, connect, getpeername, getsockname, getsockopt, listen, recv, recvfrom, send, sendto, setsockopt, shutdown, socket, socketpair

## String manipulation

atoi, snprintf, sprintf, strcat, strchr, strcmp, strcpy, strdup, strlen, strncpy, strrchr, vsprintf, vsnprintf

## Time functions

alarm, getitimer, gettimeofday, nanosleep, setitimer, time

## Virtual machine functions

quark_exec