.intel_syntax noprefix .globl _dlopen_ptr .globl _dlsym_ptr lea rcx, [rbp+0x10] mov rax, [rbp+0x8] mov rdi, [rax+0x10] mov rax, [rsp] // return address sub rax, [rip+JSC_llint_entry_call_offset] mov r9, rax // [scratch] r9 = JavaScriptCore.__TEXT.__text add rax, [rip+JSC_confstr_stub_offset] xor rbx, rbx mov ebx, [rax + 2] add rax, rbx add rax, 6 mov rax, [rax] sub rax, [rip+libsystem_c_confstr_offset] mov r10, rax // [scratch] r10 = libsystem_c base mov rax, r10 add rax, [rip+libsystem_c_dlopen_stub_offset] mov rsi, rax mov rax, r10 add rax, [rip+libsystem_c_dlsym_stub_offset] mov rdx, rax call _main ret _main: push rbp mov rbp, rsp push r14 push r15 and rsp, ~0xf mov [rip+_dlopen_ptr], rsi mov [rip+_dlsym_ptr], rdx // rdi == library base pointer (mach-o header) // rsi == argv mov rsi, rcx call _load lea rsp, [rbp - 0x10] pop r15 pop r14 pop rbp ret _mmap: push rbp mov rbp, rsp push r15 push r14 push r12 push rbx mov eax, 0x20000C5 mov r10, rcx syscall pop rbx pop r12 pop r14 pop r15 pop rbp ret _dlopen_ptr: .quad 0 _dlsym_ptr: .quad 0 JSC_confstr_stub_offset: .quad 0x0FF5370041414141 JSC_llint_entry_call_offset: .quad 0x0FF5370041414142 libsystem_c_confstr_offset: .quad 0x0FF5370041414143 libsystem_c_dlopen_stub_offset: .quad 0x0FF5370041414144 libsystem_c_dlsym_stub_offset: .quad 0x0FF5370041414145 //10.15.3 //JSC_confstr_stub_offset: .quad 0xE7D8B4 //JSC_llint_entry_call_offset: .quad 0x00361f13 //libsystem_c_confstr_offset: .quad 0x00002644 //libsystem_c_dlopen_stub_offset: .quad 0x80430 //libsystem_c_dlsym_stub_offset: .quad 0x80436 //10.15.4 //JSC_confstr_stub_offset: .quad 0xF96446 //JSC_llint_entry_call_offset: .quad 0x00380a1d //libsystem_c_confstr_offset: .quad 0x00002be4 //libsystem_c_dlopen_stub_offset: .quad 0x8021e //libsystem_c_dlsym_stub_offset: .quad 0x80224