#include #include #include #include #include #include /* * updated 16th november 2010 :p * * < J-K-Panic> andrewg. * < andrewg> hello mr J-K-Panic * < J-K-Panic> you still have the incomplete "running line" example online * < J-K-Panic> i can not stop thinking about it * < J-K-Panic> it is mocking me * < Silvio_> jkpanic; does it eat you up inside? * < Silvio_> laughing * < Silvio_> mocking * < Silvio_> poking * < J-K-Panic> yes * < J-K-Panic> it kills me * < J-K-Panic> he just single stepts the code * < J-K-Panic> he doesnt encrypt on an instruction by instruction basis * < J-K-Panic> its eating me up inside * .. * < andrewg> would you like me to update the code with "encryption is an exercise left up to the reader" J-K-Panic ? * < J-K-Panic> andrewg: yes ;) */ #define __USE_GNU #include static int int3_count; void int3(int signo, siginfo_t *info, ucontext_t *context) { printf("eip: %p\n", context->uc_mcontext.gregs[REG_EIP]); fflush(stdout); if((int3_count++ % 25) == 0) sleep(1); context->uc_mcontext.gregs[REG_EFL] |= 0x100; // re-enable the trace // flag. } int main() { struct sigaction sa; printf("Running line example code\n"); memset(&sa, 0, sizeof(struct sigaction)); sa.sa_flags = SA_SIGINFO; sa.sa_sigaction = int3; sigaction(SIGTRAP, &sa, NULL); printf("switching to running line\n"); write(1, "", 0); // We do not want to trace through .plt code, so we'll // do that resolving here. __asm__("pushf;" "popl %eax;" "orl $0x100, %eax;" // 0x100 is the trace flag. "push %eax;" "popf;"); write(1, "Going to exit after tracing through libc write;)\n", 50); //printf("tracing through libc\n"); __asm__("xorl %eax, %eax;" "incl %eax;" "int $0x80;"); }