1. A student is testing an implementation of a C function; when compiled with gcc, the following x86-64 assembly code is produced:

Size: px

Start display at page:

Download "1. A student is testing an implementation of a C function; when compiled with gcc, the following x86-64 assembly code is produced:"

Melanie Murphy
6 years ago
Views:

1 This assignment refers to concepts discussed in sections , 2.1.8, , 3.2, 3.4, and 3.7.1of csapp; see that material for discussions of x86 assembly language and its relationship to hardware and to C. You may safely ignore the discussion of x86 machine language. The course notes are also relevant. The questions are definitely "hands-on" and will require some reading beyond the course notes. Download the file HW09.tar and unpack it on a Linux system. It contains files you will need for this assignment. All questions refer to x86-64 assembly language, as produced by the gcc compiler. Unless explicitly stated otherwise, the switches m64 and O0 are always assumed. Unless indicated otherwise, all variables are local automatics of type uint32_t or uint64_t. You may work in pairs or individually for this assignment. Prepare your answers to the following questions in a plain ASCII or UTF-8 text file. Submit your file to the Curator system by the posted deadline for this assignment. No late submissions will be accepted. If you work in pairs, list the names and PIDs of both members at the beginning of the file, and submit your solution under only one PID. You will submit your answers to the Curator System ( under the heading HW A student is testing an implementation of a C function; when compiled with gcc, the following x86-64 assembly code is produced:... Q1: pushq %rbp # 1 movq %rsp, %rbp # 2 subq $40, %rsp # 3 movq %rdi, -40(%rbp) # 4 cmpq $1, -40(%rbp) # 5 ja.l2 # 6 movl $1, %eax # 7 jmp.l3 # 8.L2: # 9 movq $1, -8(%rbp) # 10 movq $1, -16(%rbp) # 11 movq $2, -32(%rbp) # 12 jmp.l4 # 13.L5: # 14 movq -8(%rbp), %rax # 15 movq -16(%rbp), %rdx # 16 addq %rdx, %rax # 17 movq %rax, -24(%rbp) # 18 movq -16(%rbp), %rax # 19 movq %rax, -8(%rbp) # 20 movq -24(%rbp), %rax # 21 movq %rax, -16(%rbp) # 22 addq $1, -32(%rbp) # 23.L4: # 24 movq -32(%rbp), %rax # 25 cmpq -40(%rbp), %rax # 26 jbe.l5 # 27 movq -24(%rbp), %rax # 28.L3: # 29 leave # 30 ret # You may work in pairs for this assignment! 1

2 a) [5 points] How many parameters does the C function receive? Justify your answer. b) [5 points] How many local automatic variables does the C function use? Justify your answer. c) [5 points] The C function contains a while loop or a do-while loop. Which type of loop is shown above? Justify your answer, and state the line numbers of the instructions that make up the while loop, including the loop test and everything else necessary to execute the loop. d) [5 points] There is also an if-statement in the C function. State the line numbers of the instructions that make up the ifstatement, including the test(s). e) [10 points] Assume the function is named Q1. Suppose that any parameters are named P1, P2, etc., in the order the parameters would be listed in the C code. Suppose the local variables are called L1, L2, etc., in the order they occur in the stack frame for the function, from high addresses to low addresses. Write C code for the function that could have yielded the x86-64 assembly code given above. Your final answer must not include any goto statements! (Be advised: you may derive a perfectly acceptable answer and find that when you compile it you get slightly different assembly code, so don't use that as your goal.) f) [5 points] In plain English, explain what this function accomplishes. This should not be a reiteration of each assembly instruction, and should be specific, i.e. this function sums the numbers from You may work in pairs for this assignment! 2

3 2. A student is testing an implementation of a C function; when compiled with gcc, the following x86-64 assembly code is produced: Q2: pushq %rbp # 1 movq %rsp, %rbp # 2 subq $24, %rsp # 3 movq %rdi, -24(%rbp) # 4 movl $0, -4(%rbp) # 5 movl $0, -8(%rbp) # 6 jmp.l2 # 7.L4: # 8 movl -4(%rbp), %edx # 9 movq -24(%rbp), %rax # 10 addq %rdx, %rax # 11 movzbl (%rax), %eax # 12 cmpb $64, %al # 13 jle.l3 # 14 movl -4(%rbp), %edx # 15 movq -24(%rbp), %rax # 16 addq %rdx, %rax # 17 movzbl (%rax), %eax # 18 cmpb $90, %al # 19 jg.l3 # 20 movl -4(%rbp), %edx # 21 movq -24(%rbp), %rax # 22 addq %rax, %rdx # 23 movl -4(%rbp), %ecx # 24 movq -24(%rbp), %rax # 25 addq %rcx, %rax # 26 movzbl (%rax), %eax # 27 addl $32, %eax # 28 movb %al, (%rdx) # 29 addl $1, -8(%rbp) # 30.L3: # 31 addl $1, -4(%rbp) # 32.L2: # 33 movl -4(%rbp), %edx # 34 movq -24(%rbp), %rax # 35 addq %rdx, %rax # 36 movzbl (%rax), %eax # 37 testb %al, %al # 38 jne.l4 # 39 movl -8(%rbp), %eax # 40 leave # 41 ret # 42 a) [5 points] How many parameters does the C function receive? Justify your answer. b) [5 points] How many local automatic variables does the C function use? Justify your answer. c) [5 points] The C function contains a while loop or a do-while loop. Which type of loop is shown above? Justify your answer, and state the line numbers of the instructions that make up the while loop, including the loop test and everything else necessary to execute the loop. d) [5 points] There is also an if-statement in the C function. State the line numbers of the instructions that make up the ifstatement, including the test(s). You may work in pairs for this assignment! 3

4 e) [10 points] Assume the function is named Q2. Suppose that any parameters are named P1, P2, etc., in the order the parameters would be listed in the C code. Suppose the local variables are called L1, L2, etc., in the order they occur in the stack frame for the function, from high addresses to low addresses. Write C code for the function that could have yielded the x86-64 assembly code given above. Your final answer must not include any goto statements! (Be advised: you may derive a perfectly acceptable answer and find that when you compile it you get slightly different assembly code, so don't use that as your goal.) f) [5 points] In plain English, explain what this function accomplishes. This should not be a reiteration of each assembly instruction, and should be specific, i.e. this function sums the numbers from Unpacking the posted tar file HW09.tar will create a subdirectory HW09 containing the following files: Q3driver.c Q3bomb.h Q3bomb.o Q3 a driver file for Q3bomb() header file for importing Q3bomb() to Q3driver.c x86-64 binary for Q3bomb() x86-64 executable for the program The executable Q3 was produced with the command: gcc o Q3 m64 O0 ggdb3 Wall Q3driver.c Q3bomb.o If you want to edit Q3driver.c for some reason, use the command above to recompile. Try executing Q3, and you'll see a message saying you must supply a string on the command line. Try running Q3 with a string of your choosing; unless you are very lucky, a segfault will occur while the function Q3bomb() is running. Your job is now to find a string that will NOT lead to a segfault when you execute Q3. There are many strings that will work. You might find one by trial and error, but that will not yield any credit. You must use gdb to analyze what happens when you execute Q3, and deduce the characteristics of a string that will prevent the segfault. An acceptable answer to this question will: Give a precise explanation of the characteristics a string must have to "defuse" the segfault. Show how you used gdb to determine the answer to the previous part. Here's a sample of my gdb session to give you some inspiration: Start gdb on the executable: Centos> gdb Q3 Set execution to halt when Q3bomb() is entered: (gdb) break Q3bomb Breakpoint 1 at 0x Run the program with a string, so we can examine execution: You may work in pairs for this assignment! 4

5 (gdb) run pleasedonotcrash Starting program: /home/hmonti/2505/hw09/q3/q3 pleasedonotcrash Breakpoint 1, 0x in Q3bomb () Let's look at the code for Q3bomb() and see what we can figure out. Unfortunately, whoever compiled Q3bomb.c did not generate debugging information, so all we can do is look at assembly code. That does give us a lot of information, but it will take some digging to get the details. At the moment, we just entered he body of the function Q3bomb(), we can use the disassem command in gdb to generate the assembly code from the machine code that's in the executable: (gdb) disassem Q3bomb 0x <+0>: push %rbp 0x <+1>: mov %rsp,%rbp 0x <+4>: sub $0x28,%rsp => 0x <+8>: mov %rdi,-0x28(%rbp) 0x c <+12>: movl $0x6f696561,-0x20(%rbp) The => indicates the instruction we are about to execute. The ni command will execute the next instruction. Aha! There's a parameter (well, we knew that if we looked in Q3driver.c). Let's see if it's correct; it should be "pleasedontcrash". How can we display it? Let's try: (gdb) ni 0x c in Q3bomb () (gdb) print $rbp - 0x28 $1 = (void *) 0x7fffffffe108 That's the address of the parameter... not what we want. Let's try: (gdb) print *($rbp - 0x28) Attempt to dereference a generic pointer. That doesn t work; $rbp 0x28 is a void*, as it says above. We need a typecast; let's try: (gdb) print *(char*) ($rbp - 0x28) $2 = 2 '\002' That doesn t work either, at least not the way we wanted; when we dereference $rbp 0x28, we get the first byte of the thing it's pointing to, which is actually a pointer to a char array. Remember, the parameter is a char*; let's try: (gdb) print *(*(char**)($rbp 0x28)) $2 = 112 'p' OK, so the first character is 'p', which is correct. Let's try a little more pointer arithmetic and see what comes next: You may work in pairs for this assignment! 5

6 (gdb) print *(*(char**)($rbp-0x28)+1) $3 = 108 'l' (gdb) print *(*(char**)($rbp-0x28)+2) $4 = 101 'e' That's all what I expected, but tedious. Let's try a memory display command: (gdb) x/sb (*(char**)($rbp - 0x28)) 0x7fffffffe4f1: "pleasedonotcrash" Now, you need to analyze the assembly code (disassem) and determine what's going on in the function Q3bomb(). That will give you all the information you need to answer the questions below. Your score on this question will depend largely on providing a good explanation of your analysis, illustrated with "snapshots" of your gdb session(s). You should look at the gdb sessions in this assignment and the course notes for inspiration. a) [10 points] Give a precise explanation of the characteristics a string must have to "defuse" the segfault. This should be as general as possible (e.g., all strings that are exactly 73 characters long and contain the substring "skunk"). b) [15 points] Show how you used gdb to determine the answer to the previous part. For this, you should write explanatory descriptions of what you did, and copy/paste in relevant parts of your gdb session. You may work in pairs for this assignment! 6

1. A student is testing an implementation of a C function; when compiled with gcc, the following x86-32 assembly code is produced:

1. A student is testing an implementation of a C function; when compiled with gcc, the following x86-32 assembly code is produced: This assignment refers to concepts discussed in the course notes on gdb and the book The Art of Debugging by Matloff & Salzman. The questions are definitely "hands-on" and will require some reading beyond