Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #![feature(asm)]
- use std::process::exit;
- #[inline(never)]
- fn main() {
- let a = Vec::from(&BUF[..]);
- let b: i64;
- let c = seed();
- let c = c.0 * c.1 * c.2 * c.3;
- let overwrite: i64;
- // seed the stack
- unsafe { asm!(
- "mov rdx, 1"
- : "={rdx}"(overwrite)
- ::: "intel", "volatile")}
- unsafe { asm!(
- "call rax"
- : "={rax}"(b)
- : "{rax}"(a.as_ptr().offset(4)) , "{rcx}"(c)
- : "{rdx}", "{memory}", "{c}c"
- : "intel", "volatile"
- ) };
- let c: i64;
- unsafe { asm!(
- "mov rax, rdx"
- : "={rax}"(c)
- : "{rdx}"(overwrite)
- :: "intel", "volatile"
- ) };
- exit((b * c) as i32);
- }
- #[inline(never)]
- fn seed() -> (u8, u8, u8, u8) {
- let a = 1u8;
- (&a as *const u8 as u8,
- &a as *const u8 as u8,
- &a as *const u8 as u8,
- &a as *const u8 as u8)
- }
- // this is "00 00 00 00 mov rax, -1; ret". of course as this does not get in executable memory it would just fault if you'd actually run this.
- const BUF: [u8; 12] = [0, 0, 0, 0, 0x48, 0xC7, 0xC0, 0xFF, 0xFF, 0xFF, 0xFF, 0xC3];
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement