I have a program with a stack based buffer overflow. It is running PIE with ASLR and DEP, however there is a section of executable code that is at a fixed location.
However, this region does not contain an int 0x80; ret gadget. I can control eax, ebx, ecx, and edx. How can I execute arbitrary syscalls to, say, call mprotect and read in shellcode? Every syscall seems to require an int 0x80, and I'm not sure how to bypass this.
There is an int 0x80 gadget in the relevant code, however it is followed by a jmp instruction.
So I'm looking for either a way to make syscalls without 0x80, or a way to make two syscalls at once (to set memory protections, read in, and execute shellcode)