3 ms·
That's the syscall instruction (0f 05). It's not jumping to that address, it's injecting the exit syscall right under the instruction pointer. If you wanted
by tux3 4y ago
That's the syscall instruction (0f 05).
It's not jumping to that address, it's injecting the exit syscall right under the instruction pointer.
If you wanted to modify the register, you'd do `set $rip = 0x050f` without the `{short}`
- pxeger1 4y agoSo would this not work if the program's code is mapped read-only?
- saagarjha 4y agoDebuggers typically bypass normal memory permissions.
- josephcsible 4y ago"typically" being important. Here's an example of where they can't: https://gist.github.com/josephcsible/c8ce72a6084634fe56928c4bd20e6d52 https://gist.github.com/josephcsible/c8ce72a6084634fe56928c4...
- saagarjha 4y agoI'm kind of confuses as to what this is doing. I see that it just unmaps everything but the loop but what does this have to do with strace?
- josephcsible 4y agoThere's only one page of executable memory left in the whole process. It doesn't contain any syscall instructions, and it's a shared mapping of a read-only file. That means the debugger can't point the instruction pointer at any existing syscall instructions, and it also can't create any new ones.
- saagarjha 4y agoRight, but why would the debugger need to do this?
- josephcsible 4y agoBecause on Linux, those are the only ways to make another process execute a syscall. (Note that the technique I'm using wouldn't work on Windows, since there, you could use VirtualAllocEx to allocate new pages in other processes.)