2023-07-22 14:30:04 +00:00
|
|
|
|
|
|
|
bits 64
|
|
|
|
|
|
|
|
section .text
|
2023-07-23 07:19:53 +00:00
|
|
|
default rel
|
|
|
|
global _start
|
|
|
|
extern __libc_global_fini
|
|
|
|
extern __libc_global_init
|
|
|
|
extern __libc_start_main
|
|
|
|
extern main
|
2023-07-22 14:30:04 +00:00
|
|
|
_start:
|
|
|
|
xor ebp, ebp
|
|
|
|
;; Save rtld_fini address to r9
|
|
|
|
mov r9, rdx
|
|
|
|
;; Get argc and argv from the stack
|
|
|
|
pop rsi
|
2023-07-22 16:28:16 +00:00
|
|
|
mov rdx, rsp
|
2023-07-22 14:30:04 +00:00
|
|
|
;; Align stack to 16, push junk and stack ptr
|
2023-07-22 15:23:39 +00:00
|
|
|
and rsp, ~0xf
|
2023-07-22 14:30:04 +00:00
|
|
|
push rax
|
|
|
|
push rsp
|
2023-07-22 16:28:16 +00:00
|
|
|
;; Load fini and init initializers as function parameters
|
2023-07-23 07:19:53 +00:00
|
|
|
push rbx
|
|
|
|
lea rbx, [__libc_global_init wrt ..plt]
|
|
|
|
mov rcx, rbx
|
|
|
|
lea rbx, [__libc_global_fini wrt ..plt]
|
|
|
|
mov r8, rbx
|
|
|
|
lea rbx, [main wrt ..plt]
|
|
|
|
mov rdi, rbx
|
|
|
|
pop rbx
|
2023-07-22 14:30:04 +00:00
|
|
|
;; Call start main
|
2023-07-23 07:19:53 +00:00
|
|
|
call __libc_start_main wrt ..plt
|
2023-07-22 14:30:04 +00:00
|
|
|
;; No idea why halt it, I guess that's a funny
|
|
|
|
;; way to crash your application if the function we called
|
|
|
|
;; returns instead of calling the exit syscall
|
|
|
|
hlt
|