Skip to content

Instantly share code, notes, and snippets.

@aaronjeline
Created January 9, 2021 18:51
Show Gist options
  • Save aaronjeline/15e4f391ff20057f7a1f9b5ab081cdb4 to your computer and use it in GitHub Desktop.
Save aaronjeline/15e4f391ff20057f7a1f9b5ab081cdb4 to your computer and use it in GitHub Desktop.
Quick little rust script for searching for raw linux syscalls
use std::io::{Read, self};
use std::fs::File;
use std::env::args;
fn main() -> io::Result<()> {
let args : Vec<_> = args().collect();
if args.len() != 3 { panic!("Invalid Args!") }
let filename = &args[1];
let syscall = &args[2];
let syscall_int : u8 = match syscall.parse() {
Ok(i) => i,
Err(_) => panic!("Couldn't parse!")
};
let results = process(filename, syscall_int)?;
println!("Matched {} times", results.len());
println!("Results are:");
for result in results {
println!("0x{:x}", result);
}
Ok(())
}
fn process(filename: &str, syscall: u8) -> io::Result<Vec<usize>> {
let mut locs = vec![];
let mut file = File::open(filename)?;
let mut buffer : Vec<u8> = vec![];
file.read_to_end(&mut buffer)?;
for i in 0..buffer.len() - 5 {
if is_push(&buffer, i, syscall) && is_syscall(&buffer, i) {
locs.push(i);
}
}
Ok(locs)
}
fn is_push(buf : &[u8], i : usize, syscall : u8) -> bool {
buf[i] == 0x6a && buf[i + 1] == syscall
}
fn is_syscall(buf : &[u8], i : usize) -> bool {
buf[i + 3] == 0x0f && buf[i + 4] == 0x05
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment