; ==============================================================================

;

; (C) 2026, Roberto A. Foglietta <roberto.foglietta@gmail.com>, MIT+1 license

;

; MIT+1: due to the extreme nature of this software, an extra clause is

; added to the standard MIT license, which forbids everyone to

; remove or change the authorship string also from the binary.

; The clause rationale is rooted in security fingerprinting and

; due to the strong -- nearly 1:1 -- match between the Assembler

; source code and the x86 32-bit executable code (human-machine).

;

; The MIT+1 licensing terms apply to all the previous, current and future

; versions, unless the author provides a public legal charter allowing a

; designated entity to be exempted from this extra clause. Comply or delete.

;

; Note: coded with the help of Kimi and Gemini for the size reduction,

; this aspect deepens the link between the human and the machine.

;

; In this specific case, MIT+1 is not a derivative of the MIT license but

; due to the peculiar and extreme nature of this source code, the license

; acts as a direct extension to the binary code generated by it (1sc:1bc).

;

; ==============================================================================

; For code blocks & comments comparison:

; sed -e "s,// ,; ," -e "s,^//,;," -i uzpexec.arm

; sed -e "s,; ,// ," -e "s,^;,//," -i uzpexec.arm

; ==============================================================================

BITS 32

BASE_ADDR equ 0x08048000 ; Loading base definition

org BASE_ADDR

; ==============================================================================

; ELF32 HEADER (Micro-Loader a 32-bit, Teeny ELF)

; ==============================================================================

elf_header:

db 0x7F, 'ELF', 1, 1, 1, 0 ; e_ident (Magic, 32bit, LSB, Version)

times 8 db 0 ; Padding for e_ident

dw 2 ; e_type (Executable)

dw 3 ; e_machine (Intel 80386)

dd 1 ; e_version

dd main.start ; e_entry (The starting point of our code)

dd phdr - elf_header ; e_phoff (Offset of the Program Header Table)

dd 0 ; e_shoff (No Section Header Table)

dd 0 ; e_flags

dw 52 ; e_ehsize (Size of this header)

dw 32 ; e_phentsize (Size of a Program Header entry)

dw 1 ; e_phnum (Only one segment needed)

; ----------------------------------------------------------------------------

; Many Linux kernel ELF parsers completely ignore these 6

; bytes when section offset e_shoff = 0, as in this case.

;

%ifndef _NO_INFOSIX

elf_infosix:

; dw 0, 0, 0 ; Section info (zeroed out, reclamable)

%endif

;

; ASSUMPTIONS CHECK

;

; Using memfd_create() and execvat() requires a Linux kernel >= 3.19 and under

; this constraint no any ELF loader will complain about these six-0's missing.

; ----------------------------------------------------------------------------

phdr:

dd 1 ; p_type (PT_LOAD - Segment to load)

dd 0 ; p_offset

dd BASE_ADDR ; p_vaddr (Virtual address in memory)

dd BASE_ADDR ; p_paddr

dd file_end - elf_header ; p_filesz (Size of the code within the file)

dd bss_end - elf_header ; p_memsz (Size of the code within memory)

; ----------------------------------------------------------------------------

dd 7 ; p_flags (R+W+X - Read, Write, and Execute)

.page4kb:

dd 0x1000 ; p_align (Standard page alignment)

; Security-by-Design VS Security-by-Subtraction

; Because uzpexec contains no input parsing logic that could be corrupted and

; its fixed length read loop cannot be overflowed, the writeable-executable

; segment offers no exploitable attack vector. They are 1024 in aarm64 binary.

; Since the loader immediately forfeits control through atomic fork() / exec()

; or execveat() transitions that never return, an attacker cannot redirect

; execution to modified code before the process image is replaced.

; An adversary who can already write to the process memory holds sufficient

; privileges to inject code via ptrace or mprotect on any standard binary,

; which means the R+W+X flag introduces zero additional risk.

; WRX is the least of your troubles, but uzpexec as obscenely-powerful tool.

; ==============================================================================

; CODE (uzpexec stub execution starts here)

; ==============================================================================

main:

; This would be the main() in a C-language sourcemain_start

; Save original argv and calculate envp from the initial stack layout

; Stack: [argc] [argv[0]] ... [argv[N]] [NULL] [envp...]

.start:

pop eax ; argc (was [esp])

mov esi, esp ; ESI = argv

lea ebp, [esi+eax*4+4] ; EBP = envp (callee-saved or SIGSEGV on [esi])

; ----------------------------------------------------------------------------

; HARDENING: NO_NEW_PRIVS & ANTI-CORE-DUMP

;

; Using umask() is omitted because memfd ignores filesystem permissions.

; Additional hardening:

; - prctl(NO_NEW_PRIVS) prevents SUID escalation,

; - prctl(PR_SET_DUMPABLE, 0) prevents core dumps,

; - F_SEAL_SEAL locks the memfd seals permanently,

; - MFD_CLOEXEC and F_SEAL_WRITE are already set.

; ----------------------------------------------------------------------------

; prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)

; Sterilize the priviledge escalation from CVE-2021-4034, pre-5.18

push 38 ; EBX = PR_SET_NO_NEW_PRIVS

pop ebx

push 1 ; ECX = 1 (enable)

pop ecx

; push 172 ; SYS_prctl

; pop eax

xor eax, eax

; xor edx, edx ; EDX = 0

cdq

mov al, 172

int 0x80 ; prctl() in best-effort

; prctl(PR_SET_DUMPABLE, 0, 0, 0, 0)

mov al, 172 ; SYS_prctl

mov bl, 4 ; EBX = PR_SET_DUMPABLE

; xor edx, edx ; EDX = 0, already set

dec ecx ; ECX = 0 (RAM !coredump)

int 0x80 ; prctl() in best-effort

; ============================================================================

; 1. Try to open itself file by /proc/self/exe

push 5 ; SYS_open, EAX shold be reset here

pop eax

mov ebx, commd_exe

push ebx ; --> m::stack { commd_exe, ... }

mov ecx, 0x00080000 ; O_RDONLY | O_CLOEXEC

int 0x80

mov edi, eax ; save FD in EDI for later

; 2. Try to open the memfd, as first operation

; mov eax, 356 ; SYS_memfd_create

mov ah, 1

mov al, 100

test esi, esi ; CVE-2021-4034, pre-5.18, can't cover LK bugs

jz short .jz_do_exit ; just exit or SIGSEGV later

mov ebx, [esi] ; argv[0]

push 3 ; MFD_ALLOW_SEALING | MFD_CLOEXEC

pop ecx

int 0x80

; Organising the stack in the proper order (inverse order of popping)

push eax ; --> m::stack { memfd1, commd_exe, ... }

; mov eax, 356 ; SYS_memfd_create

mov ah, 1

mov al, 100

int 0x80

push eax ; --> m::stack { memfd2, memfd1, commd_exe, }

push 19 ; SYS_lseek

pop eax

mov ebx, edi ; itself

mov ch, 2 ; skip size, 32-bit aligned

mov cl, 0 ; ECX = 512

; xor edx, edx ; SEEK_SET = 0, already set

int 0x80

%if 0

cmp eax, ecx

jne .do_exit ; this should never happen

%endif

; ------------------------------------------------------------------------------

; WHY -EINTR ISN'T AN ISSUE HERE (and it wasn't correctly addressed anyway)

;

; .read_loop:

;

; This loop is useless (unless proven differently) because it is not reading

; a generic FD which can be associated to anything including a pipe, but it is

; reading itself as running executable (aka /proc/self/exe) which is already

; cached by the Linux kernel which will do an atomic copy_to_user() which will

; returns in EBX the number of chars read, 512 (stub only, read STDIN) or 516

; carryload available to pass by fork() to zcat. Failure is always fatal, here.

;

; Voyager mission cannot fail because uzpexec took a bold assumption (lol).

;

; ASSUMPTIONS CHECK

;

; The stub is 512B and the standard kernel page is 4KB, everywhere the mempage

; size is bigger than 516B the read() is expected to be atomic but what about

; resides between two pages? BASE_ADDR is fine but kernel random address load

; can play a subtle role here, depending on the alignment of randomisation.

;

; 1. seeing an EINTR is possible, an interrupt arrives before read() -> EAX=0.

; 2. as long as the memory page is >= 1KB, the first 516B are cached in memory.

; 3. address randomisation doesn't play a role here, memory is flat for read().

;

; Checking results { 1:N,2:Y,3:Y }: EAX can be 516, 512 or a fatal -ERRNO, only.

;

; https://github.com/robang74/uzpexec/blob/devel/

; /doc/the-x86-asm-eintr-dilemma-question.txt

; ------------------------------------------------------------------------------

; 3. Try to read from the file the 1st block + 4 bytes to check the carryload

.read_four:

push 3 ; SYS_read

pop eax

mov ebx, edi ; input fd or STDIN

mov ecx, buf ; ECX = buf, set once here

mov dl, 4 ; EDX = 4, read four bytes

int 0x80

cmp eax, edx

je .do_copy ; read ok, there is a carryload

test edi, edi

.jz_do_exit:

jz short .do_exit

.stdin:

xor edi, edi ; EDI = 0 (STDIN)

%ifdef _NO_STDIN ; single point of detour to do_exit

jmp short .do_exit

%else ; jmp short for %-branch size balance

jmp short .read_four

%endif

; ------------------------------------------------------------------------------

; DO COPY BY READ / WRITE LOOP

;

; test: { echo '!#'; dd if=93mb.iso bs=1M; } | time -p ./uzpexec

; fast: 93 MB (88 MiB) copied, 0.28882 s, 321 MB/s

; time: real 0.30, user 0.03, sys 0.25

;

; The values above are comphrensive of all syscalls including exec(zcat -f)

; ------------------------------------------------------------------------------

.do_copy:

mov ebx, bin_path

; at this point [ecx] contains the magic number to check

cmp word [ecx], 0x2123 ; match shebang

je .use_cat

cmp word [ecx], 0x457f ; match elf bin

je .use_cat

cmp word [ecx], 0xb528 ; match zstd

je .write_four

.use_zcat:

mov dword edx, [bin_path] ; save "/bin"

mov dword [gzip_cmd], edx ; write back

jmp .write_four

.use_cat:

pop ebx ; memfd2 <-- p::stack { memfd1, commd_exe, }

pop edx ; memfd1 <-- p::stack { commd_exe, ... }

push ebx ; --> m::stack { memfd2, commd_exe, ... }

push ebx ; --> m::stack { memfd2, memfd2, commd_exe, }

.write_four:

; Write first 4 bytes, already read in buf

; push 4 ; bytes already read, to write, already set

; pop eax ; soon --> edx, size to write , already set

.pump_loop:

; Write to memfd2

pop ebx ; memfd2

push ebx

; mov ecx, buf ; already set

mov edx, eax ; bytes already read, to write

push 4 ; SYS_write

pop eax

int 0x80

; Read from input

mov dl, 0

mov dh, 14 ; EDX = 512*7, buffer size

; mov ecx, buf ; already set

mov ebx, edi ; input fd

push 3 ; SYS_read

pop eax

int 0x80

%ifdef _DO_EINTR

cmp eax, -4 ; check for -EINTR (if any, ever)

je short .pump_loop ; continue

%endif

test eax, eax

jz short .rewind ; check for EOF

js short .do_exit ; single point of detour to do_exit

jmp short .pump_loop ; continue

; ------------------------------------------------------------------------------

; ------------------------------------------------------------------------------

; THE BENEFIT OF A SHORT JUMP (and its implications)

;

; A short jump, parent.here instead of do_exit, saves 4 bytes and this jump

; lands with an EAX < 0, then sets an EDX to a value that an attacker can choose

; and .do_int: int_0x80(-N, EDX,...) which always fails and jumps to do_exit.

;

; In conclusion, this short jump is a deterministic and safe way to save 4 bytes

; of binary code and reach the exit(). The problem here is considering -EINTR an

; unrecoverable error because we stop reading and we do an useless loop (solved).

; ------------------------------------------------------------------------------

.do_exit:

jmp short parent.here

; 4. Rewind of the memfd2, set it to be ready to read as (EDI) source

.rewind:

; xor edx, edx ; SEEK_SET = 0

cdq ; EDX = 0 when EAX = 0, granted by jz .rewind

xor ecx, ecx ; SEEK_PNT = 0

pop ebx ; memfd2 <-- p::stack { memfd1, commd_exe, }

mov al, 19 ; SYS_lseek

int 0x80

; In-place stack manipulation: "/proc/self/exe" --> "/proc/self/fd/9"

pop eax ; memfd1 <-- c::stack { commd_exe }

pop edx ; commd_exe <-- c::stack { ... }

mov dword [edx + file_desc - commd_exe], 0x392f6466

push edx ; --> m::stack { slfd_path, ... }

push eax ; --> m::stack { memfd1, slfd_path, ... }

cmp ebx, eax

jne .fork ; memfd1 == memfd2, don't fork but execute

dec ebx

jmp parent

.fork:

; 4b. Fork the process

mov al, 2 ; SYS_fork

int 0x80

test eax, eax

jz child ; the child jump to its routine

; ============================================================================

; PARENT PROCESS ( p::stack { memfd1, slfd_path, ... } )

; ============================================================================

parent:

%ifdef _DO_CLOSE

; 0p. closing the source memfd2 granting the same risk with/out I/O

push 6 ; SYS_close

pop eax

; mov ebx, edi ; already set

int 0x80

mov al, 6 ; SYS_close

dec ebx

int 0x80

%endif

; 1p. The parent waits for the child completes zcat writing in memfd

.do_loop:

push 7 ; SYS_waitpid

pop eax

xor ebx, ebx

dec ebx ; = -1, every child

; xor ecx, ecx ; = 0, already, reset above

xor edx, edx ; = 0

int 0x80

add eax, 4

jz .do_loop ; -EINTR, try again

; ----------------------------------------------------------------------------

; HARDENING: F_ADD_SEALS TO MEMFD

;

; Apply F_ADD_SEALS (F_SEAL_WRITE, etc.) to the memfd exclusively

; within the ELF execution path before invoking execveat().

;

; - ELF hardening: prevents any runtime exploits from tampering with

; or rewriting the binary payload resident in RAM via /proc/self/fd/.

;

; - Script compatibility: this security measure is omitted for the

; shell interpreter branch because /bin/sh and its sub-utilities

; often require standard read/write descriptors or create temporary

; files, meaning write-restricted seals could break compatibility.

; ----------------------------------------------------------------------------

; 2p. Sealing the memfd/ELF in RO mode, for security and integrity

push 92 ; SYS_fcntl (security, set eax in full)

pop eax

pop ebx ; memfd1 <-- p::stack { slfd_path, ... }

; mov ecx, 1033 ; ECX = F_ADD_SEALS (0x0409)

mov ch, 4

mov cl, 9

; F_SEAL_WRITE | F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL = 15 (0x0f)

mov dl, 15 ; EDX = 0x0f, sealed in full

int 0x80 ; ELF hardening provided in best effort

; ----------------------------------------------------------------------------

; BINFMT MODE

; ----------------------------------------------------------------------------

; 3p. leverage the kernel/syste binfmt_script to exec scripts directly

jmp .execute_elf

; 4p. Duplicate the memfd on the FD n.9, an arbitrary high id-number.

; Initially, !noclosing FD=5 from the parent and run on it as-is

; because avoiding FD duplication reduces the binary size by 8 bytes

; but creates potentially security concerns and sub-proc pollution.

; ----------------------------------------------------------------------------

; SECURITY & ARCHITECTURAL ABOUT FD=5 INHERITANCE VS FD=9 DUP2()

;

; Omiting CLOEXEC creates a file descriptor leak. The memfd would

; cascade down to every sub-process spawned by the child process.

; The memfd is sealed read-only, but FD=5 pollutes the range 3-6

; which is used by scripts while FD=9 is the single-char highest.

; ----------------------------------------------------------------------------

.fallback:

mov al, 63 ; SYS_dup2

; mov ebx, [memfd] ; memfd1, already set

push 9 ; file descriptor

pop ecx

int 0x80

%ifdef _DO_CLOSE

mov al, 6 ; SYS_close

; mov ebx, edi ; already set

int 0x80

%endif

; 5p. Spawns a /bin/sh whose STDIN is piped to zcat, passing original argvs

mov al, 11 ; SYS_execve

pop ebx ; slfd_path <-- p::stack { ... }

pop ecx ; replace argv[1]

push ebx ; with "/proc/self/fd/9"

; mov ecx, edx

mov edx, ebp ; envp (intact from main_start)

jmp .backfall

.here:

; basic operations for calling the execve()

jmp short do_final_int

; ----------------------------------------------------------------------------

; ELF BINARY MODE (Security: harden ELF execution via read-only memfd seals)

; ----------------------------------------------------------------------------

.execute_elf:

; Execute the ELF binary using a Linux specific syscall

mov eax, 358 ; SYS_execveat, EAX requires a reset here

; mov ebx, [memfd] ; EBX = memfd1, already

push 0 ; "" on the stack

mov ecx, esp ; ECX points to ""

; Passing to the execution the original argv[] and envp[]

mov edx, esi ; EDX = argv (original)

mov esi, ebp ; ESI = envp (original)

mov di, 0x1000 ; EDI = AT_EMPTY_PATH

%ifndef _USE_EXECVE

int 0x80 ; never returns unless it fails

%endif

pop eax ; execveat() failed, reset EAX for fallback

jmp .fallback

.backfall:

lea ecx, [esp]

jmp short do_final_int

; ==============================================================================

; CHILD PROCESS ( c::stack memfd1, slfd_path, ... )

; ==============================================================================

child:

; 1c. dup2: connect memfd2 to "/proc/self/fd/9"

mov al, 63 ; SYS_dup2

; mov ebx, ... ; already set

mov cl, 9 ; = 9

int 0x80

; 2c. dup2: connect memfd1 to *cat stdout

mov al, 63 ; SYS_dup2

pop ebx ; memfd1 <-- c::stack { slfd_path, ... }

mov cl, 1 ; = 1, stdout

int 0x80

dec eax

jnz short do_final_int

; 3c. Execute external decompressor

pop ebx ; slfd_path <-- c::stack { ... }

push 0 ; end of envp/argv

push ebx ; --> /proc/self/fd/9

push cmd_flag ; "-dc\0"

sub ebx, commd_exe-gzip_cmd ; = gzip_cmd

cmp byte [ebx], '/'

je .use_gzip

sub ebx, gzip_cmd-bin_path ; = bin_path (zstd)

.use_gzip:

push ebx ; bin_path --> argv[0]

mov ecx, esp ; argv[1...]

; xor edx, edx ; envp null

cdq ; EDX = 0 <-- EAX = 0 by jnz do_final_int

mov al, 11 ; SYS_execve

; ==============================================================================

do_final_int:

int 0x80 ; it never returns, unless it fails

; ==============================================================================

; ERROR HANDLING

; ==============================================================================

do_exit:

; test eax, eax

; jz .no_error

push 4 ; SYS_write

pop eax

push 1 ; stdout

pop ebx

; Print copyright notice, version and internal name

mov ecx, copy_vers

push bin_path - copy_vers

pop edx

int 0x80

;.no_error:

; mov ebx, eax ; error from syscall

mov al, 1 ; SYS_exit

int 0x80 ; exit never fail

; ==============================================================================

; COMPACT DATA SECTION (appended to code)

; ==============================================================================

; LN | XE

copy_vers: db "(c) github/robang74/uzpexec v0.98" ; 33 | 33

%ifdef _HAS_PROVIDER

provider : db 0x20, "12345678", 0x0a ; 10 | -

%else

micro_ver: db ".3", 0x20, 0x0a ; - | 4

%endif

; following fields are conditionally overwritable, do unions

bin_path : db "/bin" ; 4 | 28 (34)

zstd_cmd : db "/zstd" ; 5

gzip_cmd : db "cat",0 ; 4 |

db "/gzip",0 ; 6 |

%ifndef _HAS_PROVIDER

times 6 db 0 ; - | -

%endif

%ifdef _NO_INFOSIX

; times 6 db 0 ; - | -

%endif

cmd_flag : db "-dc", 0 ; 3 | -

; This introduces the need of having the /proc mounted,granted after the /init

; The shorter alernative is /dev/fd/9, but it is NOT grated on embedded systems

commd_exe: db "/proc/self/"

file_desc: db "exe", 0,0 ; 16 | 16

; ----------

; 81 tot.

; ==============================================================================

; PADDING: Aligned exactly to 512 bytes (dd skip=1)

; ==============================================================================

file_end: ; Physical end of the binary file!

times (512 - ($ - $$)) db 0 ; Padding to 512 bytes for skip=1

; ==============================================================================

; BSS SECTION (RAM only, aligned to 512 bytes)

; ==============================================================================

bss_start equ $$ + 512

buf: equ bss_start ; Only variable needed besides the buffer

bss_end: equ buf + 3584 ; Eeverything stays in a 4KB memory page