.global task_pusha task_pusha: pushf push $0x8 // code segment push $userfunc push $0x666 pusha push %ds push %es push %fs push %gs /* now stack looks like: param // esp+68 returnaddy eflags code segment userfunc 0x666 eax // rest by popa ecx edx ebx esp ebp esi edi ds es fs gs */ mov 68(%esp),%eax // get address of alternative stack where we want to simulate the pusha mov (%esp),%ecx mov %ecx,(%eax) mov 4(%esp),%ecx mov %ecx,4(%eax) mov 8(%esp),%ecx mov %ecx,8(%eax) mov 12(%esp),%ecx mov %ecx,12(%eax) mov 16(%esp),%ecx mov %ecx,16(%eax) mov 20(%esp),%ecx mov %ecx,20(%eax) mov 24(%esp),%ecx mov %ecx,24(%eax) mov 28(%esp),%ecx mov %ecx,28(%eax) mov 32(%esp),%ecx mov %ecx,32(%eax) mov 36(%esp),%ecx mov %ecx,36(%eax) mov 40(%esp),%ecx mov %ecx,40(%eax) mov 44(%esp),%ecx mov %ecx,44(%eax) mov 48(%esp),%ecx mov %ecx,48(%eax) mov 52(%esp),%ecx mov %ecx,52(%eax) mov 56(%esp),%ecx mov %ecx,56(%eax) mov 60(%esp),%ecx mov %ecx,60(%eax) pop %gs pop %fs pop %es pop %ds popa pop %eax pop %eax pop %eax pop %eax ret