Date: Wed, 21 Jul 2021 18:07:38 -0300 From: Rdbo <rdbodev@gmail.com> To: freebsd-questions@freebsd.org Subject: Re: Understanding the behavior of the 32 bit mmap system call Message-ID: <CABsRSOM3_vo=zmdPojvim0hiRdOnAn1Wkmi%2BR%2BB56rL51yz2mw@mail.gmail.com> In-Reply-To: <CABsRSOOib-xWTN41cB24=y7UtTqkPREOZfVOXYksw%2B7AzSWuEQ@mail.gmail.com> References: <CABsRSOOib-xWTN41cB24=y7UtTqkPREOZfVOXYksw%2B7AzSWuEQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
By remote process, I meant a tracer. Because apparently the syscall arguments are passed on the stack, I'm gonna have to modify my shellcode a little in order for the syscall injection to work. I thought it was going to be the same way as on Linux, apparently not. I'll report back if I get it working. Em ter., 20 de jul. de 2021 =C3=A0s 09:15, Rdbo <rdbodev@gmail.com> escreve= u: > Hi, I'm a hobbyist developer working on a multiplatform, multiarch memory > library, and I chose FreeBSD to be one of the supported operating systems= . > I was playing around with the SYS_mmap system call and I noticed that, fo= r > x86_32, you have to pass a struct containing all the mmap arguments, rath= er > than the arguments themselves. The thing is, this structure is not passed > as a pointer (like on Linux, for example), so I don't see how one would d= o > this syscall from a remote process, as each register is responsible for o= ne > argument of the syscall, and a single register can't store a structure th= is > size. I've tried passing the structure as a pointer, passing each mmap > argument in a separate register (like __NR_mmap2 on Linux), looking for > alternative mmap system calls that do not require the struct parameter. > Unfortunately, these attempts have all failed. > TLDR; how to run a 32 bit SYS_mmap system call from a remote process when > a single register can't fit the whole structure and the structure is not > passed as a pointer? > Regards, rdbo >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CABsRSOM3_vo=zmdPojvim0hiRdOnAn1Wkmi%2BR%2BB56rL51yz2mw>