// author: @hc0d3r // license: wtfpl #include #include #include #include static const char syscall_sc[]= "\x48\x89\xf8" // mov %rdi,%rax "\x48\x89\xf7" // mov %rsi,%rdi "\x48\x89\xd6" // mov %rdx,%rsi "\x48\x89\xca" // mov %rcx,%rdx "\x4d\x89\xc2" // mov %r8,%r10 "\x4d\x89\xc8" // mov %r9,%r8 "\x4c\x8b\x4c\x24\x08" // mov 0x8(%rsp),%r9 "\x0f\x05" // syscall "\xc3"; // ret #define x86_64_syscall(n, args...) ((long(*)(long, ...))(syscall_sc))(n, args) int main(void){ char msg[]="Mommy I know the System V ABI\n"; x86_64_syscall(__NR_write, 1, msg, sizeof(msg)-1); void *map_addr = (void*)x86_64_syscall(__NR_mmap, 0x13370000, 4096, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0); printf("addr = %p\n", map_addr); int fd = x86_64_syscall(__NR_open, "/etc/issue", O_RDONLY); printf("fd = %d\n", fd); x86_64_syscall(__NR_close, fd); x86_64_syscall(__NR_munmap, map_addr, 4096); x86_64_syscall(__NR_exit, 5); }