Loading

syscall demo

const char *__fastcall sub_57BCDC(
        const char *needle,
        __int64 a2,
        __int64 a3,
        __int64 a4,
        __int64 a5,
        __int64 a6,
        __int64 a7,
        __int64 a8)
{
  const char *v8; // x19
  char *v9; // x1
  size_t v10; // x2
  __int64 v11; // x3
  unsigned __int64 v12; // x0
  int v13; // w20
  __int64 v14; // x0
  int v15; // w24
  char *v16; // x25
  __int64 v17; // x1
  __int64 v18; // x2
  int v19; // w19
  int *v20; // x8
  unsigned __int64 v21; // x0
  char haystack[2048]; // [xsp+8h] [xbp-808h] BYREF
  __int64 v23; // [xsp+808h] [xbp-8h]

  v23 = *(_QWORD *)(_ReadStatusReg(TPIDR_EL0) + 40);
  if ( needle )
  {
    v8 = needle;
    v9 = "/proc/self/mountinfo";
    v10 = 0;
    v11 = 0;
    v12 = linux_eabi_syscall(__NR_openat, -100, "/proc/self/mountinfo", 0);
    if ( v12 >= 0xFFFFFFFFFFFFF001LL )
      goto LABEL_13;
    if ( (v12 & 0x80000000) != 0 )
      return 0;
    v13 = v12;
    v9 = haystack;
    v10 = 2047;
    v14 = linux_eabi_syscall(__NR_read, v12, haystack, 0x7FFu);
    if ( (unsigned __int64)v14 > 0xFFFFFFFFFFFFF000LL )
    {
LABEL_11:
      *(_DWORD *)__errno(v14, v9, v10, v11, a5, a6, a7, a8) = -(int)v14;
    }
    else
    {
      v15 = 0;
      while ( v14 >= 1 )
      {
        v15 += v14;
        v16 = &haystack[v15];
        *v16 = 0;
        if ( strcasestr(haystack, v8) )
        {
          v21 = linux_eabi_syscall(__NR_close, v13);
          if ( v21 >= 0xFFFFFFFFFFFFF001LL )
            *(_DWORD *)__errno(v21, v17, v18, v11, a5, a6, a7, a8) = -(int)v21;
          return (_BYTE *)(&dword_0 + 1);
        }
        if ( v15 >= 129 )
        {
          v15 = 128;
          memmove(haystack, v16 - 128, 0x80u);
        }
        v9 = &haystack[v15];
        v10 = 2047 - v15;
        v14 = linux_eabi_syscall(__NR_read, v13, v9, v10);
        if ( (unsigned __int64)v14 > 0xFFFFFFFFFFFFF000LL )
          goto LABEL_11;
      }
    }
    v12 = linux_eabi_syscall(__NR_close, v13);
    if ( v12 < 0xFFFFFFFFFFFFF001LL )
    {
      return 0;
    }
    else
    {
LABEL_13:
      v19 = -(int)v12;
      v20 = (int *)__errno(v12, v9, v10, v11, a5, a6, a7, a8);
      needle = 0;
      *v20 = v19;
    }
  }
  return needle;
}
posted @ 2026-05-26 18:06  xtyuns  阅读(10)  评论(0)    收藏  举报