Advertisement
Guest User

Untitled

a guest
Dec 1st, 2015
14
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 2.08 KB | None | 0 0
  1. #include <stdio.h>
  2.  
  3. #ifdef __i386__
  4. # include <linux/unistd.h>
  5. # include <asm/ldt.h>
  6. # include <sys/mman.h>
  7. # include <unistd.h>
  8. # include <sys/syscall.h>
  9. # include <errno.h>
  10. #else
  11. # include <asm/prctl.h>
  12. # include <sys/prctl.h>
  13. #endif
  14.  
  15. int arch_prctl(int code, unsigned long addr);
  16.  
  17. int test_func()
  18. {
  19.   return (42);
  20. }
  21.  
  22. int main()
  23. {
  24. #ifdef __i386__
  25.   void *seg = mmap(NULL, getpagesize(), PROT_WRITE | PROT_READ,
  26.                    MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
  27.   struct user_desc u_info;
  28.   int val;
  29.  
  30.   ((void **)seg)[0x10 / sizeof(void *)] = &test_func;
  31.   u_info.entry_number = 6;
  32.   u_info.base_addr = (unsigned long)seg;
  33.   u_info.limit = getpagesize();
  34.   u_info.seg_32bit = 1;
  35.   u_info.contents = MODIFY_LDT_CONTENTS_DATA;
  36.   u_info.read_exec_only = 0;
  37.   u_info.limit_in_pages = 0;
  38.   u_info.seg_not_present = 0;
  39.   u_info.useable = 1;
  40.   val = (6 << 3 | 0 << 2 | 3);
  41.  
  42.   /* if a 32 bit program run on a 64 bit system, the first free gdt slot is 12                                                                                                                                    
  43.    * instead of 6 for 32 bit system.                                                                                                                                                                              
  44.    */
  45.   if (syscall(SYS_set_thread_area, &u_info) < 0 && errno == EINVAL) {
  46.       u_info.entry_number = 12;
  47.       val = (12 << 3 | 0 << 2 | 3);
  48.       if (syscall(SYS_set_thread_area, &u_info) < 0)
  49.           puts("Fail");
  50.   }
  51.  
  52.   __asm__ volatile ("mov %0, %%eax; \n\
  53.                     mov %0, %%fs; \n\
  54.                     call *%%fs:0x10; \n\
  55.                     mov $0x10, %%eax; \n\
  56.                     call *%%fs:(%%eax);" \
  57.                     : : "m" (val) : "eax");
  58. #else
  59.   void (*funcs[10])();
  60.  
  61.   funcs[0x10 / sizeof(void *)] = (void *)&test_func;
  62.  
  63.   arch_prctl(ARCH_SET_GS, (unsigned long)funcs);
  64.  
  65.   __asm__ volatile ("call *%gs:0x10; \n\
  66.                     mov $0x10, %rax; \n\
  67.                     call *%gs:(%rax);");
  68. #endif
  69.   return 0;
  70. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement