diff --git a/main.s b/main.s index 08aa7a1..155e949 100644 --- a/main.s +++ b/main.s @@ -38,7 +38,8 @@ # CONSTS .equ BYTES_TO_READ, 1024 -.equ PATTERN_LEN, 7 +.equ SCAN_ADVANCE, 960 +.equ PATTERN_LEN, 11 .equ BYTE_TO_WRITE, 0xc3 _start: @@ -338,6 +339,7 @@ strcmp_file: loop strcmp_file found_file: + movq $0, end_addr lea start_addr_buff, %r12 lea start_addr, %r13 mov $0, %r14 @@ -377,7 +379,7 @@ done_converting: lea end_addr, %r13 mov $0, %r14 - cmpq $0, %r13 + cmpq $0, (%r13) je convert_addr movq start_addr, %r12 @@ -385,7 +387,7 @@ done_converting: loop_addr_range: cmpq %r12, %r13 - je clear_line + jbe clear_line read_mem: subq $32, %rsp @@ -430,7 +432,7 @@ loop_read_mem: sig_scan: movq sig_scan_cnt, %rax - cmp $PATTERN_LEN - 1, %rax + cmp $PATTERN_LEN, %rax je found_match @@ -453,7 +455,32 @@ sig_scan: jmp sig_scan found_match: - addq loop_read_mem_cnt, %r12 + movq loop_read_mem_cnt, %rax + +backwards_loop: + decq %rax + cmpq $0, %rax + jl failed_match + + leaq mem_read_buff(%rip), %rbp + addq %rax, %rbp + + cmpb $0x31, 0(%rbp) + jne backwards_loop + cmpb $0xc0, 1(%rbp) + jne backwards_loop + cmpb $0x48, 2(%rbp) + jne backwards_loop + cmpb $0x85, 3(%rbp) + jne backwards_loop + cmpb $0xf6, 4(%rbp) + jne backwards_loop + cmpb $0x0f, 5(%rbp) + jne backwards_loop + cmpb $0x84, 6(%rbp) + jne backwards_loop + + addq %rax, %r12 addq $2, %r12 jmp write_mem @@ -463,7 +490,7 @@ failed_match: jmp loop_read_mem continue_loop_addr_range: - addq $1024, %r12 + addq $SCAN_ADVANCE, %r12 jmp loop_addr_range write_mem: @@ -537,15 +564,29 @@ write_mem: mov $patched_msg_len, %rdx syscall -exit: mov $SYS_CLOSE, %rax mov maps_fd, %rdi syscall - mov $SYS_EXIT, %rax + mov $SYS_EXIT, %rax mov $0, %rdi syscall +exit: + mov $SYS_WRITE, %rax + mov $1, %rdi + mov $not_found_msg, %rsi + mov $not_found_msg_len, %rdx + syscall + + mov $SYS_CLOSE, %rax + mov maps_fd, %rdi + syscall + + mov $SYS_EXIT, %rax + mov $1, %rdi + syscall + .bss dirent_buff: .space 8129 cmdline_buff: .space 512 @@ -575,7 +616,7 @@ exit: read_word: .quad 0 - pattern_bytes: .byte 49, 192, 72, 133, 246, 15, 132 + pattern_bytes: .byte 199, 69, 212, 255, 255, 255, 255, 199, 69, 216, 255 proc_dir: .asciz "/proc" maps_file: .asciz "maps" @@ -591,3 +632,6 @@ exit: patched_msg: .asciz "Patched!\n" patched_msg_len =.- patched_msg + + not_found_msg: .asciz "Pattern not found!\n" + not_found_msg_len =.- not_found_msg