; void ring3_me_please(uint32_t stackbase, uint32_t userstackbase, uint32_t entry, uint32_t argc, uint32_t argv, uint32_t cs, uint32_t ds); [global _ring3_me_please] _ring3_me_please: push ebp mov ebp, esp mov eax, [ebp+0x08] mov esp, eax ; Set up the incoming stack push dword[ebp+0x20] ; user ss push dword[ebp+0x0C] ; user esp push dword 0x0202 ; eflags push dword[ebp+0x1C] ; user cs push dword[ebp+0x10] ; user eip mov eax, dword[ebp+0x20] mov ds, eax mov es, eax mov fs, eax mov gs, eax xor eax, eax mov ebx, eax mov ecx, eax mov edx, eax mov ebp, eax mov esi, eax mov edi, eax iret