1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
.text
.align 2
/* sp -> {pthread_create, dlopen, dylib} */
#if defined(__x86_64__)
lea -8(%rsp), %rdi /* thread */
xor %rsi, %rsi /* attr */
lea thread_func(%rip), %rdx /* start_routine */
mov %rsp, %rcx /* arg */
mov %rdi, %rsp
call *(%rcx)
/* suicide */
mov $361, %rax /* bsdthread_terminate */
xor %rdi, %rdi /* stackaddr */
xor %rsi, %rsi /* freesize */
xor %rdx, %rdx /* port */
xor %rcx, %rcx /* sem */
syscall
/* still here? */
mov $0xbad, %rax
jmp *%rax
thread_func:
mov 0x8(%rdi), %rax /* dlopen */
mov 0x10(%rdi), %rdi /* dylib */
xor %rsi, %rsi
jmp *%rax
#elif defined(__i386__)
mov %esp, %ecx
push %ecx /* arg */
call 1f
1:
pop %eax
add $(thread_func - 1b), %eax
push %eax /* start_routine */
xor %eax, %eax
push %eax /* attr */
push %esp /* thread */
call *(%ecx)
/* suicide */
mov $361, %eax /* bsdthread_terminate */
xor %edx, %edx
push %edx /* sem */
push %edx /* port */
push %edx /* freesize */
push %edx /* stackaddr */
syscall
/* still here? */
mov $0xbad, %eax
jmp *%eax
thread_func:
xor %edx, %edx
push %edx
mov 0x4(%esp), %ecx /* arg */
mov 0x8(%ecx), %edx /* dylib */
push %edx
mov 0x4(%ecx), %edx /* dlopen */
push %edx
call *%eax
add $8, %esp
ret
#elif defined(__arm__)
sub sp, #4
mov r0, sp
mov r1, #0
adr r2, thread_func
add r3, sp, #4
ldr r9, [r3]
blx r9
/* suicide */
mov r0, #0
mov r1, #0
mov r2, #0
mov r3, #0
mov r12, #361
svc #0x80
/* still here? */
mov r0, #0xbad
bx r0
thread_func:
ldr r2, [r0]
ldr r0, [r0, #4]
mov r1, #0
bx r2
#elif defined(__arm64__)
sub sp, sp, #8
mov x0, sp
mov x1, #0
adr x2, 1f
add x3, sp, #4
ldr x9, [x3]
blr x9
/* suicide */
mov x0, #0
mov x1, #0
mov x2, #0
mov x3, #0
mov x12, #361 /* ??? */
svc #0x80
/* still here? */
mov x0, #0xbad
br x0
1:
ldr x2, [x0]
ldr x0, [x0, #8]
mov x1, #0
br x2
#endif
|
