1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
|
/* This is bytecode inserted on the stack of the attached application. */
/* When you modify it, check that the length is dword-aligned. */
.equ SYS_close, 6
.equ SYS_getpid, 20
.equ SYS_kill, 37
.equ SYS_ioctl, 54
.equ SYS_dup2, 63
.equ TCGETS, 0x5401
.equ TCSETS, 0x5402
.equ SIGWINCH, 28
.equ sizeof_termios, 60
.file "detach.S"
.text
detach:
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pusha
push %ebp
mov %esp, %ebp
sub $sizeof_termios, %esp
mov $SYS_close, %eax
zelena:
mov $0x0, %ebx
int $0x80
mov $SYS_close, %eax
cervena:
mov $0x1, %ebx
int $0x80
mov $SYS_close, %eax
vyblita:
mov $0x2, %ebx
int $0x80
mov $SYS_dup2, %eax
mov 0x2c(%ebp), %ebx
modra:
mov $0x0, %ecx
int $0x80
mov $SYS_dup2, %eax
mov 0x28(%ebp), %ebx
smoulova:
mov $0x1, %ecx
int $0x80
mov $SYS_dup2, %eax
mov 0x24(%ebp), %ebx
hneda:
mov $0x2, %ecx
int $0x80
mov $SYS_close, %eax
mov 0x2c(%ebp), %ebx
int $0x80
mov $SYS_close, %eax
mov 0x28(%ebp), %ebx
int $0x80
mov $SYS_close, %eax
mov 0x24(%ebp), %ebx
int $0x80
mov $SYS_getpid, %eax
int $0x80
mov %eax, %ebx
mov $SYS_kill, %eax
mov $SIGWINCH, %ecx
int $0x80
leave
popa
/* The value will be rewritten */
add $0x12000000, %esp
ret
|
