Advertisement
Guest User

clobber error

a guest
Jun 24th, 2016
22
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Rust 1.13 KB | None | 0 0
  1. #![feature(asm)]
  2. use std::process::exit;
  3.  
  4. #[inline(never)]
  5. fn main() {
  6.     let a = Vec::from(&BUF[..]);
  7.     let b: i64;
  8.     let c = seed();
  9.     let c = c.0 * c.1 * c.2 * c.3;
  10.  
  11.     let overwrite: i64;
  12.    
  13.     // seed the stack
  14.     unsafe { asm!(
  15.         "mov rdx, 1"
  16.         : "={rdx}"(overwrite)
  17.         ::: "intel", "volatile")}
  18.  
  19.     unsafe { asm!(
  20.         "call rax"
  21.         : "={rax}"(b)
  22.         : "{rax}"(a.as_ptr().offset(4)) , "{rcx}"(c)
  23.         : "{rdx}", "{memory}", "{c}c"
  24.         : "intel", "volatile"
  25.     ) };
  26.  
  27.     let c: i64;
  28.  
  29.     unsafe { asm!(
  30.         "mov rax, rdx"
  31.         : "={rax}"(c)
  32.         : "{rdx}"(overwrite)
  33.         :: "intel", "volatile"
  34.     ) };
  35.  
  36.     exit((b * c) as i32);
  37. }
  38.  
  39. #[inline(never)]
  40. fn seed() -> (u8, u8, u8, u8) {
  41.     let a = 1u8;
  42.     (&a as *const u8 as u8,
  43.      &a as *const u8 as u8,
  44.      &a as *const u8 as u8,
  45.      &a as *const u8 as u8)
  46. }
  47.  
  48. // this is "00 00 00 00 mov rax, -1; ret". of course as this does not get in executable memory it would just fault if you'd actually run this.
  49. const BUF: [u8; 12] = [0, 0, 0, 0, 0x48, 0xC7, 0xC0, 0xFF, 0xFF, 0xFF, 0xFF, 0xC3];
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement