1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
|
Test if disasm spread $mem[idx] correctly
CLI
disasm - -a x86_64
STDIN
20 00 00 00 00 00 00 00
02 00 00 00 05 00 00 00
00 00 00 00 00 00 00 00
60 00 00 00 05 00 00 00
15 00 01 00 3b 00 00 00
06 00 00 00 00 00 ff 7f
06 00 00 00 00 00 ff 7f
STDOUT
#Label CODE JT JF K
#---------------------------------
L0001: 0x20 0x00 0x00 0x00000000 $A = $syscall_nr
L0002: 0x02 0x00 0x00 0x00000005 $mem[0x5] = $A
L0003: 0x00 0x00 0x00 0x00000000 $A = 0x0
L0004: 0x60 0x00 0x00 0x00000005 $A = $mem[0x5]
L0005: 0x15 0x01 0x00 0x0000003b if ($A == execve) goto L0007
L0006: 0x06 0x00 0x00 0x7fff0000 return ALLOW
L0007: 0x06 0x00 0x00 0x7fff0000 return ALLOW
#---------------------------------
|
