blob: d88abdc6521824a69c79e2446c4be0fbc6540f19 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
|
# Create a new segment (for data) using mmap().
== code
# instruction effective address register displacement immediate
# . op subop mod rm32 base index scale r32
# . 1-3 bytes 3 bits 2 bits 3 bits 3 bits 3 bits 2 bits 2 bits 0/1/2/4 bytes 0/1/2/4 bytes
# main: (manual test if this is the last file loaded)
# EAX = new-segment(0x1000)
# . . push args
68/push 0x1000/imm32
# . . call
e8/call new-segment/disp32
# . . discard args
81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 4/imm32 # add to ESP
# write to *EAX to check that we have access to the newly-allocated segment
c7 0/subop/copy 0/mod/direct 0/rm32/EAX . . . . . 0x34/imm32 # copy to *EAX
# syscall(exit, EAX)
89/copy 3/mod/direct 3/rm32/EBX . . . 0/r32/EAX . . # copy EAX to EBX
b8/copy-to-EAX 1/imm32/exit
cd/syscall 0x80/imm8
new-segment: # len : int -> address
# . prolog
55/push-EBP
89/copy 3/mod/direct 5/rm32/EBP . . . 4/r32/ESP . . # copy ESP to EBP
53/push-EBX
# copy len to _mmap-new-segment->len
# TODO: compute _mmap-new-segment+4 before runtime
8b/copy 1/mod/*+disp8 4/rm32/sib 5/base/EBP 4/index/none . 0/r32/EAX 8/disp8 . # copy *(EBP+8) to EAX
bb/copy-to-EBX _mmap-new-segment/imm32
89/copy 1/mod/*+disp8 3/rm32/EBX . . . 0/r32/EAX 4/disp8 . # copy EAX to *(EBX+4)
# mmap(_mmap-new-segment)
bb/copy-to-EBX _mmap-new-segment/imm32
b8/copy-to-EAX 0x5a/imm32/mmap
cd/syscall 0x80/imm8
$new-segment:end:
# . epilog
5b/pop-to-EBX
89/copy 3/mod/direct 4/rm32/ESP . . . 5/r32/EBP . . # copy EBP to ESP
5d/pop-to-EBP
c3/return
== data
# various constants used here were found in the Linux sources (search for file mman-common.h)
_mmap-new-segment: # type mmap_arg_struct
# addr
00 00 00 00 # null
# len
00 00 00 00 # 0x1000
# protection flags
03 00 00 00 # PROT_READ | PROT_WRITE
# sharing flags
22 00 00 00 # MAP_PRIVATE | MAP_ANONYMOUS
# fd
ff ff ff ff # -1 since MAP_ANONYMOUS is specified
# offset
00 00 00 00 # 0 since MAP_ANONYMOUS is specified
# . . vim:nowrap:textwidth=0
|