Permalink
Browse files

- Initial commit

  • Loading branch information...
1 parent 6d99446 commit f480d29c3ac80883f2b5305bdf4dd49cba5fb033 @felipensp committed Jun 13, 2012
Showing with 617 additions and 0 deletions.
  1. +4 −0 x86/README
  2. +61 −0 x86/itoa.s
  3. +33 −0 x86/loop-over-chars.s
  4. +27 −0 x86/loop-over-numbers.s
  5. +94 −0 x86/phpasm.s
  6. +94 −0 x86/pipe.s
  7. +73 −0 x86/sigaction.s
  8. +47 −0 x86/signal.s
  9. +58 −0 x86/tausworthe.s
  10. +12 −0 x86_64/syscall-hijack/Makefile
  11. +114 −0 x86_64/syscall-hijack/hijack.S
View
@@ -0,0 +1,4 @@
+My short Assembly X86 sample codes
+
+.asm => NASM version (Intel)
+.s => GAS version (AT&T)
View
@@ -0,0 +1,61 @@
+#;
+#; integer to string
+#; Author: Felipe Pena <sigsegv>
+#; as -o itoa.o itoa.s | ld --dynamic-linker /lib/ld-linux.so.2 -lc -o itoa itoa.o
+
+ .section .data
+
+fmt: .string "%s\n"
+
+.lcomm converted, 10
+
+.set NUMBER, 123
+
+ .section .text
+
+.global _start
+
+_start:
+
+ xorl %ecx, %ecx
+ xorl %edi, %edi
+ movl $NUMBER, %eax
+
+itoa_loop:
+ # Limpa para divisão
+ xorl %edx, %edx
+
+ movl $10, %esi
+
+ # Agora nós temos o quociente em %eax
+ # e o resto da divisão em %edx
+ idiv %esi
+
+ # Convertendo para a representação em ASCII
+ addl $48, %edx
+
+ pushl %edx
+ incl %ecx
+
+ xorl $0, %eax
+ jnz itoa_loop
+
+rev_loop:
+ popl %eax
+ movl %eax, converted(, %edi, 1)
+ incl %edi
+ decl %ecx
+
+ cmpl $0, %ecx
+ jnz rev_loop
+
+ pusha
+ pushl $converted
+ pushl $fmt
+ call printf
+ addl $8, %esp
+ popa
+
+ # Exiting
+ movl $1, %eax
+ int $0x80
View
@@ -0,0 +1,33 @@
+#;
+#; Iterando cadeia de caracters
+#; Author: Felipe Pena <sigsegv>
+#;
+
+ .section .data
+
+texto: .ascii "foo\0"
+
+ .section .text
+.global _start
+
+_start:
+ xorl %edi, %edi
+ xorl %ebx, %ebx
+
+loop:
+ leal texto(, %edi, 1), %ecx
+
+ cmpb $0, (%ecx)
+ je exit
+
+ movl $4, %eax
+ movl $1, %ebx
+ movl $1, %edx
+ int $0x80
+
+ incl %edi
+ jmp loop
+exit:
+ movl $1, %eax
+ movl $0, %ebx
+ int $0x80
View
@@ -0,0 +1,27 @@
+#;
+#; Iterando numeros
+#; Author: Felipe Pena <sigsegv>
+#;
+
+ .section .data
+
+numeros: .long 10, 20, 30, 0
+
+ .section .text
+.global _start
+
+_start:
+ xorl %edi, %edi
+ xorl %ebx, %ebx
+
+loop:
+ movl numeros(, %edi, 4), %eax
+ incl %edi
+ cmpl $0, %eax
+ je exit
+ addl %eax, %ebx
+ jmp loop
+
+exit:
+ movl $1, %eax
+ int $0x80
View
@@ -0,0 +1,94 @@
+# A simple PHP extension
+#
+# Author: Felipe Pena <sigsegv>
+# Date: 2011-05-09
+#
+# ld -shared -o phpasm phpasm.o
+#
+
+ .section .bss
+
+# sizeof(zend_function_entry) = 20
+.lcomm module_functions, 40
+
+# sizeof(zend_module_entry) = 92
+.lcomm module_entry 92
+
+ .section .rodata
+extname: .string "asm"
+phpbuild: .string "API20090626,TS,debug"
+funcname: .string "helloworld"
+str: .string "hello world from Assembly! :)"
+ len = . - str - 1
+
+ .section .text
+.global get_module
+.global zif_helloworld
+
+zif_helloworld:
+ # typedef union _zvalue_value {
+ # long lval;
+ # double dval;
+ # struct {
+ # char *val;
+ # int len;
+ # } str;
+ # HashTable *ht;
+ # zend_object_value obj;
+ # } zvalue_value;
+
+ # struct _zval_struct {
+ # zvalue_value value;
+ # zend_uint refcount__gc;
+ # zend_uchar type;
+ # zend_uchar is_ref__gc;
+ # };
+
+ # return_value zval
+ movl 8(%esp), %ebx
+
+ # Changing the zval type to IS_STRING
+ movl $6, 12(%ebx)
+
+ pushl $0
+ pushl $0
+ pushl $len
+ pushl $str
+ call _estrndup
+ addl $16, %esp
+
+ # Set the pointer for our alloc'ed string
+ movl %eax, (%ebx)
+ # Set the string length
+ movl $len, 4(%ebx)
+ ret
+
+__initialize_functions:
+ movl $0, %edi
+ movl $funcname, module_functions(,%edi,4)
+
+ movl $1, %edi
+ movl $zif_helloworld, module_functions(,%edi,4)
+ ret
+
+get_module:
+ call __initialize_functions
+
+ # Zend API
+ movl $1, %edi
+ movl $20090626, module_entry(,%edi,4)
+
+ # Module name
+ movl $5, %edi
+ movl $extname, module_entry(,%edi,4)
+
+ # Functions
+ movl $6, %edi
+ movl $module_functions, module_entry(,%edi,4)
+
+ # Build ID
+ movl $22, %edi
+ movl $phpbuild, module_entry(,%edi,4)
+
+ movl $module_entry, %eax
+ ret
View
@@ -0,0 +1,94 @@
+#;
+#; Author: Felipe Pena <sigsegv>
+#;
+
+ .section .data
+.set pipe, 42
+sfmt: .string "Fd: %d\n"
+L1: .string "test\n"
+ L1len = . - L1
+
+ .section .bss
+.lcomm fds, 4
+.lcomm buff, 20
+
+ .section .text
+.global _start
+
+# Escreve em um FD
+write:
+ movl $4, %eax
+ movl 4(%esp), %ebx
+ movl 8(%esp), %ecx
+ movl 12(%esp), %edx
+
+ int $0x80
+ ret
+
+# Lê de um FD
+read:
+ movl $3, %eax
+ movl 4(%esp), %ebx
+ movl $buff, %ecx
+ movl $5, %edx
+
+ int $0x80
+
+ movl %ecx, %eax
+ ret
+
+# Imprime o file descriptor
+printfd:
+ mov 4(%esp), %eax
+
+ pushl %ebp
+ movl %esp, %ebp
+
+ pushl %eax
+ pushl $sfmt
+ call printf
+
+ addl $8, %esp
+ movl %ebp, %esp
+ popl %ebp
+ ret
+
+_start:
+ # Chama a syscall do pipe
+ movl $pipe, %eax
+ movl $fds, %ebx
+ int $0x80
+
+ # Imprime o fd do pipe
+ pushl (%ebx)
+ call printfd
+ addl $4, %esp
+
+ # Imprime o fd do pipe
+ pushl 4(%ebx)
+ call printfd
+ addl $4, %esp
+
+ pushl $L1len
+ pushl $L1
+ pushl 4(%ebx) # Escrevendo no pipe
+ call write
+ addl $12, %esp
+
+ leal fds, %eax
+ pushl (%eax)
+ call read # Lendo do pipe
+ movl %eax, %ebx
+ addl $4, %esp
+
+ leal fds, %eax
+ pushl $L1len
+ pushl %ebx
+ pushl $1 # Escrevendo no STDOUT
+ call write
+ addl $12, %esp
+
+ # Exit
+ movl $1, %eax
+ xorl %ebx, %ebx
+ int $0x80
View
@@ -0,0 +1,73 @@
+# Signal handling
+# Author: Felipe Pena <sigsegv>
+# Date: 2011-05-09
+#
+# $ as -o sigaction.o sigaction.s
+# $ ld --dynamic-linker /lib/ld-linux.so.2 -lc -o sigaction sigaction.o
+# $ ./sigaction
+# ^CExiting...
+# $ echo $?
+
+ .section .data
+
+.set SIGINT, 2
+.set SA_SIGINFO, 4
+str: .string "Exiting...\n"
+ len = . - str
+
+ .section .bss
+
+# The sigaction structure
+# sizeof(struct sigaction) = 140
+# (this might be different on your system, see sigaction.h)
+#
+# struct sigaction {
+# sighandler_t sa_handler (4 bytes)
+# sigset_t sa_mask (128 bytes)
+# int sa_flags (4 bytes)
+# void (*sa_restorer) (void); (4 bytes)
+# }
+.lcomm struct_sigaction, 140
+
+ .section .text
+.global _start
+
+__sigint_handler:
+ # Writing in STDOUT
+ movl $4, %eax
+ movl $1, %ebx
+ movl $str, %ecx
+ movl $len, %edx
+ int $0x80
+
+ # Exiting using the exit status that would be used by the system
+ # without the signal handler (i.e. 128 + signal number)
+ movl $1, %eax
+ movl $3, %ebx
+ addl $128, 4(%esp)
+ movl 4(%esp), %ebx
+ int $0x80
+
+_start:
+ # Writing the sa_handler field
+ # offsetof(struct sigaction, sa_handler) == 0
+ movl $__sigint_handler, struct_sigaction
+
+ # Writing the sa_flags field
+ # offsetof(struct sigaction, sa_flags) == 132
+ movl $132, %edi
+ movl $SA_SIGINFO, struct_sigaction(,%edi,1)
+
+ # Calling sigaction(int, const struct sigaction *, struct sigaction *)
+ pushl $0
+ pushl $struct_sigaction
+ pushl $SIGINT
+ call sigaction
+ addl $12, %esp
+
+ # Infinite loop
+ jmp .
+
+ movl $1, %eax
+ movl $0, %ebx
+ int $0x80
Oops, something went wrong.

0 comments on commit f480d29

Please sign in to comment.