3 #include <sys/syscall.h>
7 // uninitialised, but we know pi[0] is 0x0
8 int* pi
= malloc(sizeof(int));
10 // uninitialised, but we know pc[0] points to 0x0
11 char** pc
= malloc(sizeof(char*));
14 // - the syscall number itself is undefined (but we know it's
16 // - each of the scalar args are undefined
17 // - the 2nd arg points to unaddressable memory.
18 syscall(pi
[0]+__NR_write
, pi
[0], pc
[0], pi
[0]+1);