; ELF header ; e_ident: u128 ; Magic number: 0x7f454c46 = "\x7fELF" 7f 45 4c 46 ; EI_CLASS: u8 = ELFCLASS64 02 ; EI_DATA: u8 = ELFDATA2LSB 01 ; EI_VERSION: u8 = EV_CURRENT 01 ; EI_OSABI: u8 = ELFOSABI_NONE 00 ; EI_ABIVERSION: u8 = 0 00 ; EI_PAD: [u8; 7] 00 00 00 00 00 00 00 ; e_type: u16 = E_EXEC 02 00 ; e_machine: u16 = EM_X86_64 3e 00 ; e_version: u32 = EV_CURRENT 01 00 00 00 ; e_entry: u64 = 0x400078 + 0x5c d4 00 40 00 00 00 00 00 ; e_phoff: u64 = 0x40 40 00 00 00 00 00 00 00 ; e_shoff: u64 = 0x0 00 00 00 00 00 00 00 00 ; e_flags: u32 = 0 00 00 00 00 ; e_ehsize: u16 = 64 40 00 ; e_phentsize: u16 = 56 38 00 ; e_phnum: u16 = 1 01 00 ; e_shentsize: u16 = 0 00 00 ; e_shnum: u16 = 0 00 00 ; e_shstrndx: u16 = 0 00 00 ; End of ELF header ; ; Program header ; p_type: u32 = PT_LOAD 01 00 00 00 ; p_flags: u32 = PF_R | PF_X 05 00 00 00 ; p_offset: u64 = 0 00 00 00 00 00 00 00 00 ; p_vaddr: u64 = 0x400000 00 00 40 00 00 00 00 00 ; p_paddr: u64 = 0x0 00 00 00 00 00 00 00 00 ; p_filesz: u64 = 0x167 ef 01 00 00 00 00 00 00 ; p_memsz: u64 = 0x167 ef 01 00 00 00 00 00 00 ; p_align: u64 = 0x1000 00 10 00 00 00 00 00 00 ; End of program header ; ; @die: +0 ; mov rax, 60 (exit) b8 3c 00 00 00 ; mov rdi, 0 (exit code) bf 00 00 00 00 ; syscall 0f 05 ; ret c3 ; ; @fopen: ; mov rax, 2 (sys_open) b8 02 00 00 00 ; mov rsi, 0 be 00 00 00 00 ; mov rdx, 0 ba 00 00 00 00 ; syscall 0f 05 ; ret c3 ; ; fopen_write: ; mov rax, 2 (sys_open) b8 02 00 00 00 ; mov rsi, 0x241 (O_WRONLY | O_CREAT | O_TRUNC) be 41 02 00 00 ; mov rdx, 0o644 (file mode) ba a4 01 00 00 ; syscall 0f 05 ; ret c3 ; ; @fstat: ; mov rax, 5 (sys_fstat) b8 05 00 00 00 ; syscall 0f 05 ; ret c3 ; ; @fsize: ; push rdi 57 ; push rsi 56 ; call 'fstat e8 f1 ff ff ff ; pop rsi 5e ; pop rdi 5f ; mov rax, [rsi+48] (st_size) 48 8b 46 30 ; ret c3 ; ; @memcpy: ; test rdx, rdx 48 85 d2 ; jz 'memcpy_exit 74 0f ; mov al, byte [rdi] 8a 07 ; mov byte [rsi], al 88 06 ; inc rsi 48 ff c6 ; inc rdi 48 ff c7 ; dec rdx 48 ff ca ; jmp 'memcpy eb ec ; @memcpy_exit: c3 ; ; @_start: ; mov eax, dword [rsp] (argc) 8b 04 24 ; lea rbx, [rsp+8] (argv) 48 8d 5c 24 08 ; sub rsp, 0x4000 48 81 ec 00 40 00 00 ; mov r15, rsp 49 89 e7 ; mov dword [r15+0x1010], eax (store argc) 41 89 87 10 10 00 00 ; mov qword [r15+0x1018], rbx (store argv) 49 89 9f 18 10 00 00 ; cmp eax, 3 83 f8 03 ; jl 'die 0f 8c 7b ff ff ff ; ; mov rdi, qword [r15+0x1018] (argv) 49 8b bf 18 10 00 00 ; add rdi, 8 (argv[1]) 48 83 c7 08 ; mov rdi, [rdi] (argv[1]) 48 8b 3f ; call 'fopen_write e8 87 ff ff ff ; ; mov dword [r15+0x101c], eax (store file descriptor) 41 89 87 0c 10 00 00 ; mov rdi, qword [r15+0x1018] (argv) 49 8b bf 18 10 00 00 ; add rdi, 16 (argv[2]) 48 83 c7 10 ; mov rdi, [rdi] (argv[2]) 48 8b 3f ; call 'fopen e8 5b ff ff ff ; ; mov dword [r15+0x1008], eax (store file descriptor) 41 89 87 08 10 00 00 ; mov edi, eax (fd) 89 c7 ; lea rsi, [r15] 49 8d 37 ; call 'fsize e8 76 ff ff ff ; ; mov dword [r15+0x1004], eax (store file size) 41 89 87 04 10 00 00 ; mov edi, 0x400000 bf 00 00 40 00 ; mov rsi, r15 4c 89 fe ; mov edx, 0x40 (size) ba 40 00 00 00 ; call 'memcpy e8 6b ff ff ff ; ; mov edi, 0x400040 bf 40 00 40 00 ; lea rsi, [r15+0x40] 49 8d 77 40 ; mov edx, 0x38 (size) ba 38 00 00 00 ; call 'memcpy e8 58 ff ff ff ; ; mov eax, 0x78 b8 78 00 00 00 ; add eax, dword [r15+0x1004] (file size) 41 03 87 04 10 00 00 ; mov dword [r15+0x60], eax (store file end) 41 89 47 60 ; mov dword [r15+0x68], eax (store file end) 41 89 47 68 ; ; sub rax, 5 48 83 e8 05 ; add rax, 0x400000 48 05 00 00 40 00 ; mov dword [r15+0x18], eax (store file end - 5) 41 89 47 18 ; ; mov edi, dword [r15+0x100c] (fd) 41 8b bf 0c 10 00 00 ; mov rsi, r15 4c 89 fe ; mov edx, 0x78 (size) ba 78 00 00 00 ; mov eax, 1 (sys_write) b8 01 00 00 00 ; syscall 0f 05 ; @write_loop: ; mov edi, dword [r15+0x1008] (fd) 41 8b bf 08 10 00 00 ; mov rsi, r15 4c 89 fe ; mov edx, 0x1000 (size) ba 00 10 00 00 ; mov eax, 0 (sys_read) b8 00 00 00 00 ; syscall 0f 05 ; test rax, rax 48 85 c0 ; jle 'die 0f 8e ba fe ff ff ; ; mov dword [r15+0x1000], eax (store bytes read) 41 89 87 00 10 00 00 ; mov edi, dword [r15+0x100c] (fd) 41 8b bf 0c 10 00 00 ; mov rsi, r15 4c 89 fe ; mov edx, dword [r15+0x1000] (bytes read) 41 8b 97 00 10 00 00 ; mov eax, 1 (sys_write) b8 01 00 00 00 ; syscall 0f 05 ; cmp dword [r15+0x1000], 0x1000 41 81 bf 00 10 00 00 00 10 00 00 ; jz 'write_loop 74 b5 ; call 'die e8 89 fe ff ff ; end