Skip to content

Commit

Permalink
undo change to x86_64 injector
Browse files Browse the repository at this point in the history
Revert "make the x86_64 injector slightly more efficient"

This reverts commit a613c19.
  • Loading branch information
gaffe23 committed Jul 14, 2015
1 parent 58798e3 commit 90772de
Showing 1 changed file with 8 additions and 8 deletions.
16 changes: 8 additions & 8 deletions inject-x86_64.c
Original file line number Diff line number Diff line change
Expand Up @@ -103,10 +103,12 @@ void injectSharedLibrary(long mallocaddr, long freeaddr, long dlopenaddr)
// call free()
"callq *%rbx \n"
// restore previous rbx value
"pop %rbx \n"
// give control back to the injector for the last time
"int $3"
"pop %rbx"
);

// we already overwrote the RET instruction at the end of this function
// with an INT 3, so at this point the injector will regain control of
// the target's execution.
}

/*
Expand Down Expand Up @@ -208,11 +210,7 @@ int main(int argc, char** argv)
// it. we have to advance by 2 bytes here because rip gets incremented
// by the size of the current instruction, and the instruction at the
// start of the function to inject always happens to be 2 bytes long.
//
// after that, we advance by 15 more bytes in order to skip the
// function prologue generated by the compiler, which unnecessarily
// saves the previous values of rdi, rsi, and edx on the stack.
regs.rip = addr + 2 + 15;
regs.rip = addr + 2;

// pass arguments to my function injectSharedLibrary() by loading them
// into the right registers. note that this will definitely only work
Expand Down Expand Up @@ -248,6 +246,8 @@ int main(int argc, char** argv)

// copy the code of injectSharedLibrary() to a buffer.
memcpy(newcode, injectSharedLibrary, injectSharedLibrary_size - 1);
// overwrite the RET instruction with an INT 3.
newcode[injectSharedLibrary_ret] = INTEL_INT3_INSTRUCTION;

// copy injectSharedLibrary()'s code to the target address inside the
// target process' address space.
Expand Down

0 comments on commit 90772de

Please sign in to comment.