Skip to content
GitLab
Menu
Projects
Groups
Snippets
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
PoroCYon
vondehi
Commits
c3ec95d9
Commit
c3ec95d9
authored
Oct 03, 2018
by
PoroCYon
Browse files
add an option for vfork(2) support
parent
0d718e4c
Changes
2
Hide whitespace changes
Inline
Side-by-side
README.md
View file @
c3ec95d9
...
...
@@ -20,8 +20,7 @@ but even smaller. It doesn't have a 64-bit version, though.**
| Min. platform | Linux 3.19 | Linux 2.27 | Linux 2.27 | Most Unices |
| Touches filesystem | N | N | N | Y |
\*
: with compatibility for systems where
`/bin`
isn't symlinked to
`/usr/bin`
(or the other way around).
\*
: with
`NO_UBUNTU_COMPAT`
**dis**
abled.
The exact size of a shell-based unpacker depends on the exact impmelentation,
many variations exist. 'xz' means the usage of
`xzcat`
instead of
`zcat`
,
...
...
@@ -36,16 +35,37 @@ kernel is 64-bit and supports the 32-bit emulation layer.
## Usage
```
nasm -fbin -o$out vondehi.asm [-DUSE_GZIP] [-DTAG="j0!"] [-DNO_UBUNTU_COMPAT]
nasm -fbin -o$out vondehi.asm [-DUSE_GZIP] [-DTAG="j0!"] [-DNO_UBUNTU_COMPAT] \
[-DUSE_VFORK]
cat $out $intro_compressed > $final
```
By default,
`xz`
is used. A tag can be supplied to include a vanity string
in the unpacker itself, right before the data.
### Settings
*
`USE_GZIP`
(default off): use
`gzip`
(
`/bin/zcat`
) instead of
`xz`
(
`/usr/bin/xzcat`
).
*
`NO_UBUNTU_COMPAT`
(default off): assume
`/bin`
is the same as
`/usr/bin`
.
Originally named like this because on my machine,
`/bin`
is linked t
`/usr/bin`
, but on the Revision compomachine (which runs Ubuntu), it isn't.
*
`USE_VFORK`
(default off): use
`vfork(2)`
instead of
`fork(2)`
. I hope you
know what you're doing when you enable this.
*
`TAG`
(default empty): add a vanity tag right before the compressed data.
Only use this when you have bytes to spare, of course.
## How to debug it if it doesn't work
1.
`strace`
it
2.
See where errors start happening
*
This can be obscured because the code assumes eg. syscall return values to
be between
`0`
and
`255`
, so later syscalls might fail, or nonsense
syscalls might be invoked.
3.
Fix it. Somehow.
## Greets to
*
Blackle, for the original Fishypack
*
Blackle, for the original Fishypack, and for replacing the
`waitid(2)`
call
with
`waitpid(2)`
, fixing compatibility with some kernels and shaving off a
few bytes at once!
*
Shiz, for other packing/unpacking and x86-related stuff
*
Faemiyah, yx, etc., for small sh-based unpackers (yx: nice trick with
the script partially embedded in the gzip file!)
...
...
vondehi.asm
View file @
c3ec95d9
...
...
@@ -18,6 +18,7 @@
%define SYS_lseek 19
%define SYS_dup2 63
%define SYS_execveat 358
%define SYS_vfork 190
%define EBP_bias ((_start-ehdr)-(__strempty-__self))
...
...
@@ -79,7 +80,11 @@ _start.2:
;dd filesize ;~p_memsz
db
5
;~p_flags
_start.3:
%ifdef USE_VFORK
mov
al
,
SYS_vfork
%else
mov
al
,
SYS_fork
%endif
jmp
short
_start.4
;dd 5 ;~p_flags
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment