Skip to content

Instantly share code, notes, and snippets.

@cedriczirtacic
Last active September 29, 2017 21:46
Show Gist options
  • Save cedriczirtacic/03a6071ed554f079785dacf9f45ea12a to your computer and use it in GitHub Desktop.
Save cedriczirtacic/03a6071ed554f079785dacf9f45ea12a to your computer and use it in GitHub Desktop.
SIGSEGV russian roulette
#include <sys/random.h>
int main() {
void(*j)(void);
int r;
getrandom(&r, 1, GRND_RANDOM);
if ( (r%10) == 0)
j(); //j points to nowhere == SIGSEGV
return(0);
}
.section .text
.global _start
_start:
pushq %rbp
movq %rsp, %rbp
subq $1, %rbp
// call sys_getrandom
movl $318, %eax
leaq -1(%rbp), %rdi
movb $1, %sil
movb $0x2, %dl
syscall
// get n < 10
movl (%rdi), %eax
shr $1, %eax
movb $10, %bl
div %bl
shr $8, %eax
// if %al != 0 then SIGSEGV
cmpb $0, %al
jne .safe
retq
.safe:
popq %rbp
xorq %rax, %rax
xorq %rdi, %rdi
movb $60, %al
syscall
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment