2018-09-29 23:17:11 +00:00
|
|
|
## example showing mmap syscall
|
|
|
|
|
# Create a new segment using mmap, save the address, write to it.
|
|
|
|
|
#
|
|
|
|
|
# To run:
|
2018-10-01 05:49:24 +00:00
|
|
|
# $ subx translate ex12.subx -o ex12
|
2018-09-29 23:17:11 +00:00
|
|
|
# $ subx run ex12
|
|
|
|
|
# You shouldn't get a segmentation fault.
|
|
|
|
|
|
|
|
|
|
== code
|
|
|
|
|
# instruction effective address operand displacement immediate
|
|
|
|
|
# op subop mod rm32 base index scale r32
|
|
|
|
|
# 1-3 bytes 3 bits 2 bits 3 bits 3 bits 3 bits 2 bits 2 bits 0/1/2/4 bytes 0/1/2/4 bytes
|
|
|
|
|
|
|
|
|
|
# mmap(0x1000)
|
|
|
|
|
bb/copy . . . . . . . mmap_new_segment/imm32 # copy to EBX
|
|
|
|
|
b8/copy . . . . . . . 0x5a/imm32/mmap # copy 8 to EAX
|
|
|
|
|
cd/syscall 0x80/imm8
|
|
|
|
|
|
|
|
|
|
# store to *EAX
|
|
|
|
|
c7/copy 0/mod/direct 0/rm32/EAX . . . . . 0x34/imm32 # copy 0x34 to *EAX
|
|
|
|
|
|
|
|
|
|
# exit(EAX)
|
|
|
|
|
89/copy 3/mod/direct 3/rm32/EBX . . . 0/r32/EAX . . # copy EAX to EBX
|
|
|
|
|
b8/copy . . . . . . . 1/imm32/exit # copy 1 to EAX
|
|
|
|
|
cd/syscall 0x80/imm8
|
|
|
|
|
|
|
|
|
|
== data
|
|
|
|
|
# various constants used here were found in the Linux sources (search for file mman-common.h)
|
|
|
|
|
mmap_new_segment: # type mmap_arg_struct
|
|
|
|
|
# addr
|
|
|
|
|
00 00 00 00 # null
|
|
|
|
|
# len
|
|
|
|
|
00 01 00 00 # 0x1000
|
|
|
|
|
# protection flags
|
|
|
|
|
03 00 00 00 # PROT_READ | PROT_WRITE
|
|
|
|
|
# sharing flags
|
|
|
|
|
22 00 00 00 # MAP_PRIVATE | MAP_ANONYMOUS
|
|
|
|
|
# fd
|
|
|
|
|
ff ff ff ff # -1 since MAP_ANONYMOUS is specified
|
|
|
|
|
# offset
|
|
|
|
|
00 00 00 00 # 0 since MAP_ANONYMOUS is specified
|
|
|
|
|
|
|
|
|
|
# vim:ft=subx:nowrap:tw&
|
