Created
August 14, 2020 01:33
-
-
Save iximeow/fb849af0b374422899eb539a0119031c to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <signal.h> | |
#include <stdlib.h> | |
#include <stdio.h> | |
#include <sys/ucontext.h> | |
#include <stdint.h> | |
void interpret(char op) { | |
printf("interpreting %02x\n", op); | |
} | |
void done() { | |
printf("all done!\n"); | |
} | |
void handler(int signal, siginfo_t *info, void *context) { | |
ucontext_t *uctx = (ucontext_t*)context; | |
// /!\ OSX!! /!\. | |
// uint64_t curr_instr = uctx->uc_mcontext->__ss.__rip; | |
uint64_t curr_instr = uctx->uc_mcontext.gregs[16]; | |
char op = *(char*)(curr_instr + 1); | |
uint64_t next_instr = curr_instr + 2; | |
interpret(op); | |
uctx->uc_mcontext.gregs[16] = (*(char*)next_instr == 0x00 ? done : next_instr); | |
} | |
struct sigaction act = { | |
.sa_sigaction = handler, | |
.sa_mask = 0, | |
.sa_flags = SA_SIGINFO | |
}; | |
// get this to sit in executable space :) | |
// for macho targets: | |
// char foo[] __attribute__ ((section ("__TEXT,_foo"))) = | |
// gcc/elf target: fix warning like | |
// > /tmp/ccDOtPro.s:113: Warning: ignoring changed section attributes for .text | |
// emitted because section(X) writes `.section X,"aw",@progbits` | |
// so ".text" writes `.section .text,"aw",@progbits, where the extra elements are invalid for ELF. | |
// instead, use ".text#", so the gas listing is `section .text#,"aw",@progbits`, commenting out the warning-causing junk | |
char foo[] __attribute__ ((section (".text#"))) = | |
{ 0x06, 0x01, 0x06, 0x0a, 0x06, 0x0f, 0x06, 0x01, 0x06, 0x00, 0x00 }; | |
int main(int argc, char** argv) { | |
sigaction(SIGILL, &act, (void*)0); | |
((void (*)())foo)(); | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment