[

Current Mood

|

amused

]

_start:         push    esp
                call    get_vsyscall
                xchg    ebp,eax

                mov     eax, 20
                call    ebp
                
                mov     eax, 1
                call    ebp

get_vsyscall:   push    esi
                push    ecx
                mov     eax, [esp + 12]         ; orig_esp
                mov     esi, [eax]              ; argc
                lea     eax, [eax + 4]          ; argv
                lea     esi, [eax + esi*4 + 4]  ; envp
                cld
                ; skip  environment
.skipenv:       lodsd
                or      eax, eax
                jnz     .skipenv
                ; look through the aux vector
.nextaux:       lodsd
                mov     ecx,eax
                or      eax,eax
                jz      .notfound
                lodsd
                cmp     ecx, 32
                jne     .nextaux
.notfound:      pop     ecx
                pop     esi
                ret

                push    0x41
                push    0x20
                push    datasegv
                push    0x00
                mov     eax, 123
                mov     ebx, 1
                mov     ecx, esp
                mov     edx, 16
                call    ebp
                add     esp, 16
                push    7
                pop     gs
                mov     [gs:4], ebp
                ...
                call    [gs:4]