2 ms·

Can't you change personality (from 32bit to 64bit) without exec? And then jump into your new code? (I understand this is not necessarily a solution to the ques

by remram 4y ago

Can't you change personality (from 32bit to 64bit) without exec? And then jump into your new code? (I understand this is not necessarily a solution to the question and the existing solution is probably a better fit, but I'm curious)

rep_lodsb 4y ago
Yes you can. For 32 -> 64, and assuming the OS supports both modes in the same process, this code should be sufficient: switch_to_64bit: pop edx ;EDX=return address xor ebx,ebx ;EBX=selector .next_sel: add bx,8 ;try next jc .exit ;none found, -> segfault lar eax,bx ;load access rights jnz .next_sel ;failed? and eax,0x60F400 ;mask bits cmp eax,0x20F000 ;64bit code selector? jne .next_sel ;no .exit: or bl,3 ;set RPL to ring3 push ebx ;selector push edx ;offset retfd ;go there