September Morn Update

This commit is contained in:
Ingy döt Net 2019-09-12 10:33:56 -07:00
parent 4e2d22a71d
commit aac6731f2c
6856 changed files with 141342 additions and 21127 deletions

View file

@ -1,4 +1,8 @@
The task requires poking machine code directly into memory and executing it. This is strictly for x86 (32 bit) architectures. The machine code is the opcodes of the following simple program:
The task requires poking machine code directly into memory and executing it.
This is strictly for x86 (32 bit) architectures.
The machine code is the opcodes of the following simple program:
<lang asm>mov EAX, [ESP+4]
add EAX, [ESP+8]
@ -9,9 +13,12 @@ which translates into the following opcodes:
and in Hex this would correspond to the following:
("8B" "44" "24" "4" "3" "44" "24" "8" "C3")
;Task:
Implement the following in your favorite programming language (take the common lisp code as an example if you wish):
<ol>
<li> Poke the above opcodes into a memory pointer</li>
<li>Excute it with the following arguments: [ESP+4] => unsigned-byte argument of value 7; [ESP+8] => unsigned-byte argument of value 12; The result would be 19.</li>
<li>Execute it with the following arguments: [ESP+4] => unsigned-byte argument of value 7; [ESP+8] => unsigned-byte argument of value 12; The result would be 19.</li>
<li>Free the Pointer</li>
</ol>
<br><br>

View file

@ -0,0 +1 @@
--- {}

View file

@ -0,0 +1,10 @@
pushq %rbp
movq %rsp, %rbp
movl %edi, -0x4(%rbp)
movl %esi, -0x8(%rbp)
movl -0x4(%rbp), %esi
addl -0x8(%rbp), %esi
movl %esi, -0xc(%rbp)
movl -0xc(%rbp), %eax
popq %rbp
retq

View file

@ -0,0 +1,71 @@
>>SOURCE FORMAT IS FIXED
IDENTIFICATION DIVISION.
PROGRAM-ID. MC.
DATA DIVISION.
WORKING-STORAGE SECTION.
01 INSTRUCTIONS.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'55'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'48'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'89'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'E5'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'89'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'7D'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'FC'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'89'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'75'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'F8'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'8B'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'75'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'FC'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'03'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'75'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'F8'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'89'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'75'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'F4'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'8B'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'45'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'F4'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'5D'.
03 USAGE BINARY-CHAR UNSIGNED VALUE H'C3'.
01 MMAP.
03 MMAP-ADDR USAGE POINTER VALUE NULL.
03 MMAP-LEN USAGE BINARY-LONG UNSIGNED VALUE 24.
03 MMAP-PROT USAGE BINARY-INT VALUE H'0007'.
03 MMAP-FLAGS USAGE BINARY-INT VALUE H'1002'.
03 MMAP-FD USAGE BINARY-INT VALUE -1.
03 MMAP-OFFSET USAGE BINARY-LONG VALUE 0.
03 CODE-PTR USAGE PROCEDURE-POINTER.
01 ARG-A USAGE BINARY-INT VALUE 7.
01 ARG-B USAGE BINARY-INT VALUE 12.
01 RESULT USAGE BINARY-INT.
LINKAGE SECTION.
01 MACHINE-CODE PIC X(24).
PROCEDURE DIVISION.
MAIN SECTION.
PERFORM SET-UP.
CALL CODE-PTR USING
BY VALUE ARG-A
BY VALUE ARG-B
RETURNING RESULT.
DISPLAY RESULT.
PERFORM TEAR-DOWN.
STOP RUN.
SET-UP SECTION.
CALL 'mmap' USING
BY VALUE MMAP-ADDR
BY VALUE MMAP-LEN
BY VALUE MMAP-PROT
BY VALUE MMAP-FLAGS
BY VALUE MMAP-FD
BY VALUE MMAP-OFFSET
RETURNING CODE-PTR.
SET ADDRESS OF MACHINE-CODE TO CODE-PTR.
MOVE INSTRUCTIONS TO MACHINE-CODE.
TEAR-DOWN SECTION.
SET ADDRESS OF MACHINE-CODE TO NULL.
CALL 'munmap' USING
BY VALUE CODE-PTR
BY VALUE MMAP-LEN.

View file

@ -0,0 +1,47 @@
package main
import "fmt"
/*
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <string.h>
typedef unsigned char byte;
typedef byte (*mcfunc) (byte, byte);
void runMachineCode(void *buf, byte a, byte b) {
mcfunc fp = (mcfunc)buf;
printf("%d\n", fp(a, b));
}
*/
import "C"
func main() {
code := []byte{
144, // Align
144,
106, 12, // Prepare stack
184, 7, 0, 0, 0,
72, 193, 224, 32,
80,
139, 68, 36, 4, 3, 68, 36, 8, // Rosetta task code
76, 137, 227, // Get result
137, 195,
72, 193, 227, 4,
128, 203, 2,
72, 131, 196, 16, // Clean up stack
195, // Return
}
le := len(code)
buf := C.mmap(nil, C.size_t(le), C.PROT_READ|C.PROT_WRITE|C.PROT_EXEC,
C.MAP_PRIVATE|C.MAP_ANON, -1, 0)
codePtr := C.CBytes(code)
C.memcpy(buf, codePtr, C.size_t(le))
var a, b byte = 7, 12
fmt.Printf("%d + %d = ", a, b)
C.runMachineCode(buf, C.byte(a), C.byte(b))
C.munmap(buf, C.size_t(le))
C.free(codePtr)
}

View file

@ -0,0 +1,38 @@
using Cxx
cxx"""
#include <stdio.h>
#include <sys/mman.h>
#include <string.h>
int test (int a, int b)
{
/*
mov EAX, [ESP+4]
add EAX, [ESP+8]
ret
*/
char code[] = {0x8B, 0x44, 0x24, 0x4, 0x3, 0x44, 0x24, 0x8, 0xC3};
void *buf;
int c;
/* copy code to executable buffer */
buf = mmap (0,sizeof(code),PROT_READ|PROT_WRITE|PROT_EXEC,
MAP_PRIVATE|MAP_ANON,-1,0);
memcpy (buf, code, sizeof(code));
/* run code */
c = ((int (*) (int, int))buf)(a, b);
/* free buffer */
munmap (buf, sizeof(code));
return c;
}
int main ()
{
printf("%d\n", test(7,12));
return 0;
}
"""
julia_function = @cxx main()
julia_function()

View file

@ -0,0 +1,44 @@
extern crate libc;
#[cfg(all(
target_os = "linux",
any(target_pointer_width = "32", target_pointer_width = "64")
))]
fn main() {
use std::mem;
use std::ptr;
let page_size: usize = 4096;
let (bytes, size): (Vec<u8>, usize) = if cfg!(target_pointer_width = "32") {
(
vec![0x8b, 0x44, 0x24, 0x04, 0x03, 0x44, 0x24, 0x08, 0xc3],
9,
)
} else {
(vec![0x48, 0x89, 0xf8, 0x48, 0x01, 0xf0, 0xc3], 7)
};
let f: fn(u8, u8) -> u8 = unsafe {
let mut page: *mut libc::c_void = ptr::null_mut();
libc::posix_memalign(&mut page, page_size, size);
libc::mprotect(
page,
size,
libc::PROT_EXEC | libc::PROT_READ | libc::PROT_WRITE,
);
let contents: *mut u8 = page as *mut u8;
ptr::copy(bytes.as_ptr(), contents, 9);
mem::transmute(contents)
};
let return_value = f(7, 12);
println!("Returned value: {}", return_value);
assert_eq!(return_value, 19);
}
#[cfg(any(
not(target_os = "linux"),
not(any(target_pointer_width = "32", target_pointer_width = "64"))
))]
fn main() {
println!("Not supported on this platform.");
}

View file

@ -0,0 +1,34 @@
import Foundation
typealias TwoIntsOneInt = @convention(c) (Int, Int) -> Int
let code = [
144, // Align
144,
106, 12, // Prepare stack
184, 7, 0, 0, 0,
72, 193, 224, 32,
80,
139, 68, 36, 4, 3, 68, 36, 8, // Rosetta task code
76, 137, 227, // Get result
137, 195,
72, 193, 227, 4,
128, 203, 2,
72, 131, 196, 16, // Clean up stack
195, // Return
] as [UInt8]
func fudge(x: Int, y: Int) -> Int {
let buf = mmap(nil, code.count, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANON, -1, 0)
memcpy(buf, code, code.count)
let fun = unsafeBitCast(buf, to: TwoIntsOneInt.self)
let ret = fun(x, y)
munmap(buf, code.count)
return ret
}
print(fudge(x: 7, y: 12))