[Ptrace]Linux内存替换（五）x86_64平台代码注入

上一节完成了x86平台的简单代码注入，本节将该过程移植到x86_64平台下测试成功。

【测试环境】
CentOS 5.4 （Final）x86_64
Linux version 2.6.18-164.el5. x86_64
GCC version 4.4.2 20080704

【汇编编译环境】
CentOS 7 x86_64
Linux 3.10.0-229.7.2.el7.x86_64
NASM 2.10.07 x86_64

【A程序：counter.c】与先前一致

#include <sys/time.h>
#include <stdio.h>

long long timeum(){
    struct timeval tim; 
    gettimeofday (&tim , NULL);
    return (long long)tim.tv_sec*1000000+tim.tv_usec;
}

int main()
{
    int i;
    long long start,tmp;
    start = timeum();
    for(i = 0; i < 60; ++i){
        printf("My Counter: %d\n", i);
        sleep(1);
        tmp = timeum();
        printf("Time Interval: %lld\n",tmp-start);
        start = tmp;
    }
    return 0;
}

gcc -o counter counter.c

【C程序：hello64.asm】详细解释

global _start
_start:
    jmp short string

code:
    pop rsi
    mov rax,1
    mov rdi,1
    mov rdx,13
    syscall

    int3

string:
    call code
    db 'Hello world!',0x0a

<