Skip to content

Instantly share code, notes, and snippets.

@b4284
Created October 17, 2015 15:28
Show Gist options
  • Save b4284/c1f01bfc0ea0f73f3295 to your computer and use it in GitHub Desktop.
Save b4284/c1f01bfc0ea0f73f3295 to your computer and use it in GitHub Desktop.
#include <inttypes.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <unistd.h>
#include <string.h>
/* 00000000004004b6 <pass1>: */
/* 4004b6: 55 push %rbp */
/* 4004b7: 48 89 e5 mov %rsp,%rbp */
/* 4004ba: 89 7d fc mov %edi,-0x4(%rbp) */
/* 4004bd: 8b 45 fc mov -0x4(%rbp),%eax */
/* 4004c0: 83 c0 01 add $0x1,%eax */
/* 4004c3: 5d pop %rbp */
/* 4004c4: c3 retq */
int pass1(int x) {
return (x + 1);
}
int main() {
uint8_t pass1a[] = {
0x55, 0x48, 0x89, 0xe5, 0x89, 0x7d, 0xfc, 0x8b,
0x45, 0xfc, 0x83, 0xc0, 0x01, 0x5d, 0xc3
};
size_t pagesize = sysconf(_SC_PAGESIZE);
int (*pass1b)(int) = aligned_alloc(pagesize, pagesize);
memcpy(pass1b, pass1a, sizeof pass1a);
if (mprotect(pass1b, sizeof pass1b, PROT_EXEC) != 0) {
perror("mprotect failed:");
return -1;
}
return pass1b(123);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment