运行下面这段代码(amd64 Linux或MacOS),并分析它的工作方式。
//goodbye.c
#include <stdio.h>
#include <sys/mman.h>
char *s = "Fnncaxd";
typedef int func(int);
int main() {
unsigned char bytes[] = {
'U', 'H', 0x89, 0xe5, 0x89, '}', 0xfc, 0x8b,
'}', 0xfc, 0x83, 0xc7, 0x01, 0x89, 0xf8, ']',
0xc3, 0, 0, 0, 0, 0, 0, 0
};
void *page = (void *)((unsigned long)bytes & ~0xfff);
if (mprotect(page, 0x1000, PROT_READ | PROT_WRITE | PROT_EXEC)) {
perror("mprotect");
}
char c;
while ((c = *s++) != 0) {
putchar(((func *)((void *)bytes))(c));
}
putchar('\n');
return 0;
}
网友评论