blob: 67eca04e6c2d2d8a0422dc4379c9762c3e958c75 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
.global usermode
usermode:
mov 0x4(%esp),%edx //get adress of passed : void func()
//to be called in ring 3
// 0x23 is user data segment (|2 low bits)
// 0x1b is user code segment (|2 low bits)
// set segment registers
mov $0x23, %ax
mov %ax, %ds
mov %ax, %es
mov %ax, %fs
mov %ax, %gs
// ss is handled by iret
mov %esp, %eax
pushl $0x23 // user data segment
pushl %eax // current stack
pushf //
// http://x86.renejeschke.de/html/file_module_x86_id_145.html
//mov $0x200, %eax
//push %eax // eflags image
pushl $0x1B // return code segment selector
push %edx // return instruction pointer
iret
jmp . // never to be reached
|
