Should we support `socketx0` convention for AARCH Windows/osx/Linux stagers?
In testing and landing https://github.com/rapid7/metasploit-framework/pull/21744, I realized that we are inconsistent in supporting the socket registry conventions on our staged payloads. Our x86 and x86_64 second stages assume the socket value will be left in EDI or RDI by the stager.
That's a tall ask on AARCH64, yet in the osx stager, we declare it is sockedi complaint, and there's no way we're saving the socket in edi on an aarch64 host.
See https://github.com/rapid7/metasploit-framework/blob/e5d3b9126f1eff3bbc98eace5081543a3a141ac0/modules/payloads/stagers/osx/aarch64/reverse_tcp.rb#L31
Instead, we're probably storing the socket in x0, and we could start using that convention, but the underlying check has a regex that assumes 3 alpha chars: : https://github.com/rapid7/metasploit-framework/blob/35a405ba0382bcb0074de5b5ecc2bbb6a3f8e6df/lib/msf/core/payload/stager.rb#L261
I don't think our Linux stagers have this check, and I think the best thing would be to remove the compatibility check from the AARCH64 stagers since it does not actually do anything?
Source: rapid7/metasploit-framework