#include #include #define UNPROTECT(addr,len) (mprotect((void*)(addr-(addr%len)),len,PROT_READ|PROT_WRITE|PROT_EXEC)) void __attribute__((constructor)) initialize(void) { char *x = 0x6010A8; // Address in empty space of I_WANT_SPACE x[0] = 'p'; x[1] = 'h'; x[2] = 'p'; x[3] = '\n'; x[4] = 0x00; UNPROTECT(0x400530,4096); // 0x400530 is the address of the main() space int *t = 0x400552; // mov edi, offset teste ; "HUEBR\n" - Adress to offset teste *t = x; x = 0x40056F; // mov eax, 0 - Before last line x[0] = 0x48; x[1] = 0xc7; x[2] = 0xc0; t = x + 3; *t = 0x40053A; // Address of start of the main() function excluding the stack pushes. x[7] = 0xff; x[8] = 0xe0; }