前一篇中介绍了arm shellcode基本用法，现在涉及到arm和thumb状态
在前一篇中默认为arm32模式：
text:00008074 ; Segment type: Pure code
.text:00008074 AREA .text, CODE
.text:00008074 ; ORG 0x8074
.text:00008074 CODE32
.text:00008074
.text:00008074 EXPORT _start
.text:00008074 _start
.text:00008074 MOV R2, #0x10
.text:00008078 ADR R1, ascii ; "hello shell\n"
.text:0000807C MOV R0, #1
.text:00008080 MOV R7, #4
.text:00008084 SVC 0
.text:00008088 SUB R0, R0, R0
.text:0000808C MOV R7, #1
.text:00008090 SVC 0
.text:00008090 ; ---------------------------------------------------------------------------
.text:00008094 ascii DCB "hello shell",0xA,0 ; DATA XREF: .text:00008078o
.text:000080A1 DCB 0, 0, 0
.text:000080A1 ; .text ends若要转化为thumb状态则需要先得到thumb状态的地址存放到r6，然后通过bx r6命令来转换：
.section .text
.global _start_start:.code 32#thumb-Mode onadd r6, pc, #1bx r6.code 16mov r2, #16adr r1, asciimov r0, $0x1mov r7, $0x4svc 0// _exitsub r0, r0, r0mov r7, #1svc 0ascii:.string "hello shell\n".balign 4效果如下：
.text:00008074 AREA .text, CODE
.text:00008074 ; ORG 0x8074
.text:00008074 CODE32
.text:00008074
.text:00008074 EXPORT _start
.text:00008074 _start
.text:00008074 ADR R6, (loc_807C+1)
.text:00008078 BX R6 ; loc_807C
.text:0000807C ; ---------------------------------------------------------------------------
.text:0000807C CODE16
.text:0000807C
.text:0000807C loc_807C ; CODE XREF: .text:00008078j
.text:0000807C ; DATA XREF: .text:_starto
.text:0000807C MOVS R2, #0x10
.text:0000807E ADR R1, ascii ; "hello shell\n"
.text:00008080 MOVS R0, #1
.text:00008082 MOVS R7, #4
.text:00008084 SVC 0
.text:00008086 SUBS R0, R0, R0
.text:00008088 MOVS R7, #1
.text:0000808A SVC 0
.text:0000808A ; ---------------------------------------------------------------------------
.text:0000808C ascii DCB "hello shell",0xA,0 ; DATA XREF: .text:0000807Eo
.text:00008099 DCB 0, 0xC0, 0x46
.text:00008099 ; .text ends若主函数是thumb状态，而子函数是32位arm的话，需要用到blx指令来做状态转换，可以这样做：
.section .text
.global _start_start:.code 32#thumb-Mode onadd r6, pc, #1bx r6.code 16//blx _writeblx j_writemov r2, #16adr r1, ascii2mov r0, $0x1mov r7, $0x4svc 0// _exitsub r0, r0, r0mov r7, #1svc 0j_write:.code 32b _write
_write:STMFD SP!, {R0-R7,LR}mov r2, #16adr r1, asciimov r0, $0x1mov r7, $0x4svc 1LDMFD SP!, {R0-R7,PC}
ascii:.string "hello shell\n".balign 4
ascii2:.string "shell storm\n".balign 4效果如下：
.text:00008074 AREA .text, CODE
.text:00008074 ; ORG 0x8074
.text:00008074 CODE32
.text:00008074
.text:00008074 ; =============== S U B R O U T I N E =======================================
.text:00008074
.text:00008074
.text:00008074 EXPORT _start
.text:00008074 _start
.text:00008074 01 60 8F E2 ADR R6, (loc_807C+1)
.text:00008078 16 FF 2F E1 BX R6 ; loc_807C
.text:0000807C ; ---------------------------------------------------------------------------
.text:0000807C CODE16
.text:0000807C
.text:0000807C loc_807C ; CODE XREF: _start+4j
.text:0000807C ; DATA XREF: _starto
.text:0000807C 00 F0 08 E8 BLX j_write
.text:00008080 10 22 MOVS R2, #0x10
.text:00008082 0F A1 ADR R1, ascii2 ; "shell storm\n"
.text:00008084 01 20 MOVS R0, #1
.text:00008086 04 27 MOVS R7, #4
.text:00008088 00 DF SVC 0
.text:0000808A 00 1A SUBS R0, R0, R0
.text:0000808C 01 27 MOVS R7, #1
.text:0000808E 00 DF SVC 0
.text:0000808E ; End of function _start
.text:0000808E
.text:00008090 CODE32
.text:00008090
.text:00008090 ; =============== S U B R O U T I N E =======================================
.text:00008090
.text:00008090
.text:00008090 j_write ; CODE XREF: _start:loc_807Cp
.text:00008090 FF FF FF EA B _write
.text:00008094 ; ---------------------------------------------------------------------------
.text:00008094
.text:00008094 _write ; CODE XREF: j_writej
.text:00008094 FF 40 2D E9 STMFD SP!, {R0-R7,LR}
.text:00008098 10 20 A0 E3 MOV R2, #0x10
.text:0000809C 0C 10 8F E2 ADR R1, ascii ; "hello shell\n"
.text:000080A0 01 00 A0 E3 MOV R0, #1
.text:000080A4 04 70 A0 E3 MOV R7, #4
.text:000080A8 01 00 00 EF SVC 1
.text:000080AC FF 80 BD E8 LDMFD SP!, {R0-R7,PC}
.text:000080AC ; End of function j_write
.text:000080AC
.text:000080AC ; ---------------------------------------------------------------------------
.text:000080B0 68 65 6C 6C 6F 20 73 68+ascii DCB "hello shell",0xA,0 ; DATA XREF: j_write+Co
.text:000080BD 00 00 00 DCB 0, 0, 0
.text:000080C0 73 68 65 6C 6C 20 73 74+ascii2 DCB "shell storm",0xA,0 ; DATA XREF: _start+Eo
.text:000080CD 00 00 00 DCB 0, 0, 0
.text:000080CD ; .text ends
