raminspect 0.7.2

A library for the arbitrary inspection and manipulation of the memory and code of a process on a Linux system.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

[BITS 64]
NULL equ 0x00
O_RDONLY equ 0x00
SYS_READ equ 0x00
SYS_OPEN equ 0x02
SYS_MMAP equ 0x09
SYS_CLOSE equ 0x03
PROT_READ equ 0x01
PROT_EXEC equ 0x04
PROT_WRITE equ 0x02
MAP_SHARED equ 0x01
MAP_ANONYMOUS equ 0x20

mov rax, SYS_MMAP
mov rdi, NULL
mov rsi, [rel $ + (alloc_size - $)]
mov rdx, PROT_READ | PROT_WRITE | PROT_EXEC
mov r10, MAP_ANONYMOUS | MAP_SHARED
mov r8, -1
mov r9, 0
syscall

mov [rel $ + (out_ptr - $)], rax

mov rax, SYS_OPEN
lea rdi, [rel $ + (devpath - $)]
mov rsi, O_RDONLY
mov rdx, NULL
syscall

mov rdi, rax
mov rax, SYS_READ
mov rsi, NULL
mov rdx, 1
syscall

mov rax, SYS_CLOSE
syscall
jmp $

device_fd: dq 0
devpath: db "/dev/raminspect", 0

out_ptr: dq 0
alloc_size: dq 0