Stack Debugging. Young W. Lim Tue. Young W. Lim Stack Debugging Tue 1 / 70

Transcription

1 Stack Debugging Young W. Lim Tue Young W. Lim Stack Debugging Tue 1 / 70

2 Outline 1 Based on 2 Introduction Compiling to IA32 Assembly Checking /proc/<pid>/maps file Checking the main stack frame 3 Stack Frames Using gdb Stack Frame Pointers Functions and Stack Frames 4 Calling Convention Function Call and Return Function Prologue and Epilogue Enter and Leave Instructions example codes and output results handling arguments and return value analyzing func2() analyzing func1() analyzing Young W. Limmain() Stack Debugging Tue 2 / 70

3 Based on "Self-service Linux: Mastering the Art of Problem Determination", Mark Wilding "Computer Architecture: A Programmer s Perspective", Bryant & O Hallaron I, the copyright holder of this work, hereby publish it under the following licenses: GNU head Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled GNU Free Documentation License. CC BY SA This file is licensed under the Creative Commons Attribution ShareAlike 3.0 Unported License. In short: you are free to share and make derivative works of the file under the conditions that you appropriately attribute it, and that you distribute it only under a license compatible with this one. Young W. Lim Stack Debugging Tue 3 / 70

4 preparation : for Linux Mint install packages lib32gcc1 lib32gcc-dbg gcc-multilib gcc -m32 t.c Young W. Lim Stack Debugging Tue 4 / 70

5 stack frame address range stack frame starts from 0xc stack bottom : 0xc stack address range 0xbfffe000 (low address) 0xc (high address) stack grows toward lower address from HIGH address (0xc ) to LOW address (0xbfffe000) Young W. Lim Stack Debugging Tue 5 / 70

6 stack frame in the Linux Mint stack address range 0xc (from HIGH address) 0xbfffe000 (to LOW address) 0x stack address range in the Linux Mint 0xfffc9000 (from HIGH address) 0xfffa8000 (to LOW address) 0x these addresses are not fixed Young W. Lim Stack Debugging Tue 6 / 70

7 code for displaying /proc/<pid>/maps local variables (stack variables) : var local variable address : 0xff9e00e8 #include <stdio.h> #include <sys/types.h> #include <unistd.h> #include <stdlib.h> int main(int argc, char *argv[]) { int var = 5; char cmd[64]; } printf(" &var = %p\n", &var ); sprintf(cmd, "cat /proc/%d/maps", getpid()); system(cmd); Young W. Lim Stack Debugging Tue 7 / 70

8 result for displaying /proc/<pid>/maps &var = 0xff9e00e r-xp : /home/young/a.out a000 r--p : /home/young/a.out 0804a b000 rw-p : /home/young/a.out 0851b c000 rw-p :00 0 [heap] f75fb000-f75fc000 rw-p :00 0 f75fc000-f77a9000 r-xp : /lib32/libc-2.23.so f77a9000-f77aa p 001ad000 08: /lib32/libc-2.23.so f77aa000-f77ac000 r--p 001ad000 08: /lib32/libc-2.23.so f77ac000-f77ad000 rw-p 001af000 08: /lib32/libc-2.23.so f77ad000-f77b1000 rw-p :00 0 f77ce000-f77d0000 r--p :00 0 [vvar] f77d0000-f77d2000 r-xp :00 0 [vdso] f77d2000-f77f4000 r-xp : /lib32/ld-2.23.so f77f4000-f77f5000 rw-p :00 0 f77f5000-f77f6000 r--p : /lib32/ld-2.23.so f77f6000-f77f7000 rw-p : /lib32/ld-2.23.so ff9c1000-ff9e2000 rw-p :00 0 [stack] Young W. Lim Stack Debugging Tue 8 / 70

9 fields in /proc/<pid>/maps (from 1 ) address: the address space in the process that it occupies perms: a set of permissions offset: the offset into the mapping dev: the device (major:minor) inode: the inode on that device. pathname: shows the name associated file for this mapping address perms offset dev inode pathname fffa8000-fffc9000 rw-p :00 0 [stack] (1) ff9c1000-ff9e2000 rw-p :00 0 [stack] (2) 1 how-to-identify-stack-and-heap-segments-in-proc-pid-maps-file Young W. Lim Stack Debugging Tue 9 / 70

10 perms & inode fields perms: a set of permissions r = read w = write x = execute s = shared p = private (copy on write) inode: the inode on that device. 0 indicates that no inode is associated with the memory region like BSS (uninitialized data) Young W. Lim Stack Debugging Tue 10 / 70

11 pathname field pathname If the mapping is associated with a file: the name of the associated file for this mapping If the mapping is not associated with a file: [heap] = the heap of the program [stack] = the stack of the main process [stack:1001] = the stack of the thread with tid 1001 [vdso] = the "virtual dynamic shared object", the kernel system call handler empty = the mapping is anonymous. Young W. Lim Stack Debugging Tue 11 / 70

12 stack elements in /proc/<pid>/maps file addr(stack_var) = 0xff9200e8 address perms offset dev inode pathname ff9c1000-ff9e2000 rw-p :00 0 [stack] [from HIGH] ff9e2000 V ff9e00e8 : &var V [to LOW ] ff9c1000 Young W. Lim Stack Debugging Tue 12 / 70

13 ELF stack contents [from HIGH] ff9e stack bottom 1 path name specified in exec() 2 environment variables 3 argv strings 4 argc 5 aux vectors [from HIGH] ff9e2000 1, 2, 3, 4, 5 V ff9e00e8 : &var [to LOW ] ff9c1000 Young W. Lim Stack Debugging Tue 13 / 70

14 code for checking the main stack frame (1) #include <stdio.h> #include <sys/types.h> #include <unistd.h> #include <stdlib.h> extern char **environ; int main(int argc, char *argv[]) { int var = 5; char cmd[64]; printf(" *environ = %p\n", *environ ); printf("1. argv[0] = %p\n", argv[0] ); printf("2. environ = %p\n", environ ); printf("3. argv = %p\n", argv ); printf("4. &argc = %p\n", &argc ); printf(" &var = %p\n", &var); Young W. Lim Stack Debugging Tue 14 / 70

15 code for checking the main stack frame (2) printf(" *environ = %s\n", *environ ); printf("1. argv[0] = %s\n", argv[0] ); printf("2. *environ = %p\n", *environ ); printf("3. *argv = %p\n", *argv ); printf("4. argc = %d\n", argc ); printf(" var = %d\n", var); sprintf(cmd, "cat /proc/%d/maps", getpid()); system(cmd); return 0; } Young W. Lim Stack Debugging Tue 15 / 70

16 results for the main stack frame (1)... 0xffcc [from HIGH] *environ = 0xffce938b 1. argv[0] = 0xffce environ = 0xffce866c 3. argv = 0xffce &argc = 0xffce85d0 &var = 0xffce8568 V... 0xffcea000...[to LOW ] *environ = LC_PAPER=ko_KR.UTF-8 1. argv[0] =./a.out 2. *environ = 0xffce938b 3. *argv = 0xffce argc = 1 var = 5 Young W. Lim Stack Debugging Tue 16 / 70

17 results for the main stack frame (2) r-xp : /home/young/a.out a000 r--p : /home/young/a.out 0804a b000 rw-p : /home/young/a.out 08ca cc4000 rw-p :00 0 [heap] f75fd000-f75fe000 rw-p :00 0 f75fe000-f77ab000 r-xp : /lib32/libc-2.23.so f77ab000-f77ac p 001ad000 08: /lib32/libc-2.23.so f77ac000-f77ae000 r--p 001ad000 08: /lib32/libc-2.23.so f77ae000-f77af000 rw-p 001af000 08: /lib32/libc-2.23.so f77af000-f77b3000 rw-p :00 0 f77d0000-f77d2000 r--p :00 0 [vvar] f77d2000-f77d4000 r-xp :00 0 [vdso] f77d4000-f77f6000 r-xp : /lib32/ld-2.23.so f77f6000-f77f7000 rw-p :00 0 f77f7000-f77f8000 r--p : /lib32/ld-2.23.so f77f8000-f77f9000 rw-p : /lib32/ld-2.23.so ffcc9000-ffcea000 rw-p :00 0 [stack] Young W. Lim Stack Debugging Tue 17 / 70

18 using gdb to check stack frames use gdb break func3 run backtrace main() -> func1() -> func2() -> func3() var str i c 3 "Hello, world!" 1 \ #3 #2 #1 #0 Young W. Lim Stack Debugging Tue 18 / 70

19 example code #include <stdio.h> #include <unistd.h> void func3( int *a ) { int c = \0 ; printf("pid = %d; ", getpid()); printf("press <Enter> \n"); c = fgetc( stdin ); void func2( char *s ) { int i = 1; func3( &i ); printf("i = %d \n", i); } void func1( int m ) { char str[] = "Hello, world!"; func2( str ); } } printf("c=%c\n", c); *a = 9; int main(void) { int var = 3; func1( var ); return 0; } Young W. Lim Stack Debugging Tue 19 / 70

20 gdb commands gdb a.out ---> GNU gdb (Ubuntu ubuntu1~16.04) Copyright (C) 2016 Free Software Foundation, Inc.... (gdb) break func3 Punto de interrupción 1 at 0x : file t.c, line 7. (gdb) run Starting program: /home/young/a.out Breakpoint 1, func3 (a=0xffffd068) at t.c:7 7 int c = \0 ; (gdb) backtrace #0 func3 (a=0xffffd068) at t.c:7 #1 0x080485ab in func2 (s=0xffffd09e "Hello, world!") at t.c:19 #2 0x e in func1 (m=3) at t.c:26 #3 0x in main () at t.c:32 (gdb) Young W. Lim Stack Debugging Tue 20 / 70

21 gdb stack frame numbering [from HIGH] - stack bottom 1 main() - gdb #3 2 func1() - gdb #2 3 func2() - gdb #1 4 func3() - gdb #0 break point #0 func3 (a=0xffffd068) at t.c:7 #1 0x080485ab in func2 (s=0xffffd09e "Hello, world!") at t.c:19 #2 0x e in func1 (m=3) at t.c:26 #3 0x in main () at t.c:32 Young W. Lim Stack Debugging Tue 21 / 70

22 Stack frame pointers (1) Full Downward Stack BP_old old stack frame V... SP_old BP_new new stack frame V... SP_new pushl movl subl %ebp %esp, %ebp $16, %esp Young W. Lim Stack Debugging Tue 22 / 70

23 Stack frame pointers (2) BP_old old stack frame V... SP_old BP_new new stack frame V... SP_new - old BP must be saved on the stack - pushl %ebp - stack grows downward - decreasing new SP for manual push operation BP_old old stack frame V [BP_old] SP_old BP_new new stack frame V [xxxxx]... SP_new pushl movl subl %ebp %esp, %ebp $16, %esp Young W. Lim Stack Debugging Tue 23 / 70

24 c source code #include <stdio.h> void func1( int m ) { int i = 99; } int main(void) { int i = 3; gcc -m32 -S -Wall t.c t.c -> t.s t.c func1( i ); return 0; } Young W. Lim Stack Debugging Tue 24 / 70

25 generated assembly (1).file.text.globl.type "t.c" func1 func1:.lfb0:.lfe0:.cfi_startproc pushl %ebp.cfi_def_cfa_offset 8.cfi_offset 5, -8 movl %esp, %ebp.cfi_def_cfa_register 5 subl $16, %esp movl $99, -4(%ebp) nop leave.cfi_restore 5.cfi_def_cfa 4, 4 ret.cfi_endproc.size.globl.type func1,.-func1 main Young W. Lim Stack Debugging Tue 25 / 70

26 generated assembly (2) main:.lfb1:.lfe1:.cfi_startproc pushl %ebp.cfi_def_cfa_offset 8.cfi_offset 5, -8 movl %esp, %ebp.cfi_def_cfa_register 5 subl $16, %esp movl $3, -4(%ebp) pushl -4(%ebp) call func1 addl $4, %esp movl $0, %eax leave.cfi_restore 5.cfi_def_cfa 4, 4 ret.cfi_endproc.size main,.-main.ident "GCC: (Ubuntu ubuntu1~ ).section.note.GNU-stack,"",@progbits Young W. Lim Stack Debugging Tue 26 / 70

27 func1() analysis func1:.lfb0:.lfe0: function prologue pushl %ebp movl %esp, %ebp subl $16, %esp movl $99, -4(%ebp) nop function epilogue leave ret void func1( int m ) { // the local stack variable // stored at %ebp-4 int i = 99; } Young W. Lim Stack Debugging Tue 27 / 70

28 main() analysis main:.lfb1:.lfe1: function prologue pushl %ebp movl %esp, %ebp subl $16, %esp movl $3, -4(%ebp) pushl -4(%ebp) call func1 addl $4, %esp movl $0, %eax function epilogue leave ret int main(void) { // local stack variable // at %ebp-4 int i = 3; // the argument $3 // the value at %ebp-4 // pushed on the stack // before calling func1() func1( i ); // return value $0 // is stored in %eax return 0; } Young W. Lim Stack Debugging Tue 28 / 70

29 Omitting frame pointer compiler option -fomit-frame-pointer -fno-omit-frame-pointer Young W. Lim Stack Debugging Tue 29 / 70

30 Function Call 1 push the return address (%esp -= 4, then push %eip) 2 jump to the start of the called function return address the address of the instruction immediately following the call instruction - Direct call : call label - Indirect call : call *operand operand : - offset Imm - a base register Eb - an index register Ei - a scalefactor s Young W. Lim Stack Debugging Tue 30 / 70

31 Function Return 1 pops the return address from the stack 2 jump to the return address location the SP must points to the location where the correct return address can be stored leave instruction does this stack preparation Young W. Lim Stack Debugging Tue 31 / 70

32 Function Prologue 1 push %ebp stores the BP (base pointer) of the previous frame on the stack decrements SP by 4 bytes (long: 32bits) 2 mov %esp %ebp updates the BP (base pointer) with the SP (stack pointer) BP always points to the current stack bottom (higher address) SP always points to the current stack top (lower address) SP always points to full (non-empty) word 3 sub $16 %esp to allocate local variables stack grows downward SP points 4 bytes lower address 16-byte alignment Young W. Lim Stack Debugging Tue 32 / 70

33 Function Epilogue 1 mov %ebp %esp deallocates locals and clear the current stack frame increments the SP to the original SP the original SP was stored in the BP 2 pop %ebp restores the original BP the current BP points where the orginal BP was stored on the stack 3 ret returns to the caller pops the return address (the last value from the stack) jumps to this return address leave instruction does movl %ebp %esp popl %ebp Young W. Lim Stack Debugging Tue 33 / 70

34 Comparison creates a new stack frame function prologue pushl %ebp movl %esp, %ebp old BP stored on the stack old SP becomes new BP new BP points to the stored old BP delete the current stack frame function epilogue movl %ebp, %esp popl %ebp current BP points to the stored old BP this BP becomes new SP take the stored old BP Young W. Lim Stack Debugging Tue 34 / 70

35 enter instruction prepares the stack frame after entering to the callee equivalent instructions as follows - push the current %ebp - new %ebp points where this old %ebp is saved - the last stack content is this savd %ebp - the 2nd last stack content is the return address (^) push %ebp ;; push the old %ebp mov %esp %ebp ;; new %ebp = the old %esp... <--%ebp <--%esp0..r.addr.. %ebp0 <--%esp <-- %ebp Young W. Lim Stack Debugging Tue 35 / 70

36 leave instruction prepares the stack frame for returning to the caller equivalent instructions as follows - current %esp points where the old %ebp was saved - restore %ebp by this saved old %ebp - the last stack content is the saved old %ebp - the 2nd last stack content is the return address (^) movl %ebp, %esp pop %ebp ;; restored %esp1 = the current %ebp ;; restored %ebp1 = the saved old %ebp <--%ebp0 <--%ebp r.addr.. <--%esp1 %ebp0 <-- %ebp %ebp0 <--%esp Young W. Lim Stack Debugging Tue 36 / 70

37 example C codes for checking the X86 calling convention int func2( int i, int j, int k ) { int val = i+j+k; main() --> func1() --> func2() val val val 0 0 i+j+k func1(a) func2(b,c,d)... #include <stdio.h> #define A 1 #define B 2 #define C 3 #define D 4 return val; } int func1( int m ) { int val = 0; val = func2( B, C, D ); return val; } int main(void) { int val = 0; val = func1( A ); return val; } Young W. Lim Stack Debugging Tue 37 / 70

38 checking calling convention - generated assembly (1).file "t.c".text....globl func2.type func2: [AAA].size func2,.-func2....globl func1.type func1: [BBB].size func1,.-func1....globl main.type main: [CCC].size main,.-main....ident "GCC:....section... func2: [AAA].LFB0: [[ func2 ]].LFE0: func1: [BBB].LFB1: [[ func1 ]].LFE1: main: [CCC].LFB2: [[ main ]].LFE2: Young W. Lim Stack Debugging Tue 38 / 70

39 checking calling convention - generated assembly (2) func2: [AAA].LFB0:.cfi_startproc pushl %ebp.cfi_def_cfa_offset 8.cfi_offset 5, -8 movl %esp, %ebp.cfi_def_cfa_register 5 subl $16, %esp movl 8(%ebp), %edx movl 12(%ebp), %eax addl %eax, %edx movl 16(%ebp), %eax addl %edx, %eax movl %eax, -4(%ebp) movl -4(%ebp), %eax leave.cfi_restore 5.cfi_def_cfa 4, 4 ret.cfi_endproc.lfe0 func1: [BBB].LFB1:.cfi_startproc pushl %ebp.cfi_def_cfa_offset 8.cfi_offset 5, -8 movl %esp, %ebp.cfi_def_cfa_register 5 subl $16, %esp movl $0, -4(%ebp) pushl $4 pushl $3 pushl $2 call func2 addl $12, %esp movl %eax, -4(%ebp) movl -4(%ebp), %eax leave.cfi_restore 5.cfi_def_cfa 4, 4 ret.cfi_endproc.lfe1: Young W. Lim Stack Debugging Tue 39 / 70

40 checking calling convention - generated assembly (3) main:.lfb2: [CCC].cfi_startproc pushl %ebp.cfi_def_cfa_offset 8.cfi_offset 5, -8 movl %esp, %ebp.cfi_def_cfa_register 5 subl $16, %esp movl $0, -4(%ebp) pushl $1 call func1 addl $4, %esp movl %eax, -4(%ebp) movl -4(%ebp), %eax leave.cfi_restore 5.cfi_def_cfa 4, 4 ret.cfi_endproc.lfe2: Young W. Lim Stack Debugging Tue 40 / 70

41 pushing arguments on to the stack frame storing arguments onto the stack from the right to the left in the reverse order the first argument is save at the last func(a, B, C, D); < push D -> push C -> push B -> push A Young W. Lim Stack Debugging Tue 41 / 70

42 storing return value to %eax regsiter store the return value in the %eax register movl leave ret -4(%ebp), %eax stack grows downward %ebp : BP %ebp-4 : 4 bytes downward from BP the word at %ebp-4 is moved to %eax a local stack variable is stored here its value is the return value the old BP is stored at %ebp Young W. Lim Stack Debugging Tue 42 / 70

43 1. analyzing func2() - (1) func2:.lfb0: pushl %ebp movl %esp, %ebp subl $16, %esp movl 8(%ebp), %edx movl 12(%ebp), %eax addl %eax, %edx movl 16(%ebp), %eax addl %edx, %eax movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret int func2( int i, int j, int k ) { int val = i+j+k; return val; } main() -> func1() -> func2() - just after func2() is called - %ebp & %esp of the caller func1() - [old %ebp] %ebp of main() %ebp - 0 : [old %ebp] <-- %ebp %ebp - 4 : $0 %ebp - 8 : $4 %ebp - c : $3 %ebp -10 : $2 %ebp -14 : [Ret address] <-- %esp Young W. Lim Stack Debugging Tue 43 / 70

44 1. analyzing func2() - (2) func2:.lfb0: pushl %ebp movl %esp, %ebp subl $16, %esp movl 8(%ebp), %edx movl 12(%ebp), %eax addl %eax, %edx movl 16(%ebp), %eax addl %edx, %eax movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret after function prolog is executed - [old %ebp] %ebp of func1() %ebp - 4 : $0 %ebp - 8 : $4 %ebp+10 %ebp - c : $3 %ebp+c %ebp -10 : $2 %ebp+8 %ebp -14 : [Ret address] %ebp+4 %ebp -18 : [old %ebp] <-- %esp <-- %ebp - just before leave %ebp +14 : $0 %ebp +10 : $4 %ebp + c : $3 %ebp + 8 : $2 %ebp + 4 : [Ret address] %ebp %ebp - 4 : [val]... %ebp -10 : : [old %ebp] <-- %ebp <-- %esp Young W. Lim Stack Debugging Tue 44 / 70

45 2. analyzing func1() - (1) func1:.lfb1: pushl %ebp movl %esp, %ebp subl $16, %esp movl $0, -4(%ebp)... pushl $4 pushl $3 pushl $2... call func2 addl $12, %esp movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret LFE1: #define B 2 #define C 3 #define D 4 int func1( int m ) { int val = 0; val = func2( B, C, D ); return val; } - push arguements on the stack - from the right argument - to the left argument - just after executing the function prologue %ebp - 0 : [old %ebp] <-- %ebp <= %esp %ebp - 4 : %ebp - 8 : %ebp - c : %ebp -10 : <-- %esp <= %esp-16 Young W. Lim Stack Debugging Tue 45 / 70

46 2. analyzing func1() - (2) func1:.lfb1: pushl %ebp movl %esp, %ebp subl $16, %esp movl $0, -4(%ebp)... pushl $4 pushl $3 pushl $2... call func2 addl $12, %esp movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret LFE1: - just after call func2 - call instruction pushes the return address on the stack %ebp - 4 : $0 (init val) %esp+10 %ebp - 8 : $4 %esp+c %ebp - c : $3 %esp+8 %ebp -10 : $2 %esp+4 %ebp +14 : [ret addr] <-- %esp - just after ret from func2 - ret instruction pops the return address from the stack %ebp - 4 : [updated val] %esp+c %ebp - 8 : $4 %esp+8 %ebp - c : $3 %esp+4 %ebp -10 : $2 <-- %esp Young W. Lim Stack Debugging Tue 46 / 70

47 2. analyzing func1() - (3) func1:.lfb1: pushl %ebp movl %esp, %ebp subl $16, %esp movl $0, -4(%ebp)... pushl $4 pushl $3 pushl $2... call func2 addl $12, %esp movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret LFE1: - after returning from func2() decrease stack by 12 bytes - the SP now points to the stack variable val - the return value from func2 in %eax - val is updated with this return value - this value is stored to %eax the return value of func1() %ebp - 4 : XX <-- %esp %ebp - 8 : $4 %ebp - c : $3 %ebp -10 : $2 Young W. Lim Stack Debugging Tue 47 / 70

48 3. analyzing main() - (1) main:.lfb2: pushl %ebp movl %esp, %ebp subl $16, %esp movl $0, -4(%ebp)... pushl $1... call func1 addl $4, %esp movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret LFE2: #define A 1 int main(void) { int val = 0; val = func1( A ); return val; } - just after executing the function prologue %ebp - 0 : [old %ebp] <-- %ebp <= %esp %ebp - 4 : %ebp - 8 : %ebp - c : %ebp -10 : <-- %esp <= %esp-16 Young W. Lim Stack Debugging Tue 48 / 70

49 3. analyzing main() - (2) main:.lfb2: pushl %ebp movl %esp, %ebp subl $16, %esp movl $0, -4(%ebp)... pushl $1... call func1 addl $4, %esp movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret LFE2: - just after call func1 - call instruction pushes the return address on the stack %ebp - 4 : $0 (init val) %esp+14 %ebp - 8 : %esp+10 %ebp - c : %esp+c %ebp -10 : %esp+8 %ebp +14 : $1 %esp+4 %ebp +18 : [ret addr] <-- %esp - just after ret from func1 - ret instruction pops the return address from the stack %ebp - 4 : $0 (init val) %esp+10 %ebp - 8 : %esp+c %ebp - c : %esp+8 %ebp -10 : %esp+4 %ebp +14 : $1 <-- %esp } Young W. Lim Stack Debugging Tue 49 / 70

50 3. analyzing main() - (3) main:.lfb2: pushl %ebp movl %esp, %ebp subl $16, %esp movl $0, -4(%ebp)... pushl $1... call func1 addl $4, %esp movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret LFE2: - after returning from func1() decrease stack by 4 bytes - the return value from func2 in %eax - val is updated with this return value - this value is stored to %eax the return value of main %ebp - 4 : XX %ebp - 8 : %ebp - c : %ebp -10 : } <-- %esp Young W. Lim Stack Debugging Tue 50 / 70

51 call by reference example code #include <stdio.h> #include <unistd.h> void func3( int *a ) { int c = \0 ; printf("pid = %d; ", getpid()); printf("press <Enter> \n"); c = fgetc( stdin ); void func2( char *s ) { int i = 1; func3( &i ); printf("i = %d \n", i); } void func1( int m ) { char str[] = "Hello, world!"; func2( str ); } } printf("c=%c\n", c); *a = 9; int main(void) { int var = 3; func1( var ); return 0; } Young W. Lim Stack Debugging Tue 51 / 70

52 example code summary main( ) {local: var=3} func1(var) func1( m ) {local: str[]="hello, world!"} func2(str) func2( *s ) {local: i=1} func3(&i) print i func3( *a ) {local: c= \0 } print pid & Press <Enter> c=fgetc(stdin) print c *a=9 Young W. Lim Stack Debugging Tue 52 / 70

53 call by reference : generated assembly structure.lc3:.string "i = %d \n".file "t.c".text.section.rodata.globl func2.lc0:.type "pid = %d; " func2:....lc1:.size func2,.-func2.string "Press <Enter> ".globl func1.lc2:.type "c=%c\n" func1:....text.size func1,.-func1.globl func3.globl main.type func3:... main:....size func3,.-func3.size main,.-main.section.rodata.ident "GCC: (Ubuntu ubuntu1~.section.note.GNU-stack,"",@p Young W. Lim Stack Debugging Tue 53 / 70

54 call by reference : printf string constants.lc0:.lc1:.lc2:.lc3:.string "pid = %d; ".string "Press <Enter> ".string "c=%c\n".string "i = %d \n" void func3( int *a ) {... printf("pid = %d; ", getpid()); printf("press <Enter> \n");... printf("c=%c\n", c);... } void func2( char *s ) {... printf("i = %d \n", i); } Young W. Lim Stack Debugging Tue 54 / 70

55 call by reference : main (1) main:.lfb3:.lfe3: leal 4(%esp), %ecx ;; %ecx = %esp+4 andl $-16, %esp ;; 0xFFFFFFF0 pushl -4(%ecx) ;; push [%ecx-4],%esp -= 4 pushl %ebp ;; push %ebp, %esp -= 4 movl %esp, %ebp ;; %ebp = %esp pushl %ecx ;; push %ecx, %esp -= 4 subl $20, %esp ;; %esp -= 20 movl $3, -12(%ebp) ;; [%ebp-12] = 3 ;; int var = 3; subl $12, %esp ;; %esp -= 12 pushl -12(%ebp) ;; push [%ebp-12]... call func1 ;; func1( var ); addl $16, %esp ;; %esp += 16 movl $0, %eax ;; %eax = 0 ;; return 0; movl -4(%ebp), %ecx ;; %ecx = [%ebp-4] leave ;; %esp = %ebp pop %ebp leal -4(%ecx), %esp ;; %esp = %ecx-4 ret Young W. Lim Stack Debugging Tue 55 / 70

56 call by reference : main (2) main:.lfb3: %ecx = %esp+4 %ecx= init %esp+4 0xFFFFFFF0 16-byte alignment of %esp push [%ecx-4] %esp -= 4 push init %esp, %esp -= 4 push %ebp %esp -= 4 push init %ebp, %esp -= 4 %ebp = %esp new %ebp = %esp (aligned %esp-8) push %ecx %esp -= 4 push init %esp+4, %esp -= 4 %esp -= 20 enlarge %esp by 20 %esp -= 20 [%ebp-12] = 3 ;; int var = 3; (%ebp-12) = (%ecx) = (init %esp+4) %esp -= 12 enlarge %esp by 12 %esp -= 12 push [%ebp-12] push arg (=var), %exp -= 4 func1( var ); function call %esp += 16 contrict %esp by 16 %esp += 16 %eax = 0 ;; return 0; return value of main() = 0 %ecx = [%ebp-4] %ecx = init %esp %esp = %ebp ;; pop %ebp %esp = init %ebp %esp = %ecx-4.lfe3: Young W. Lim Stack Debugging Tue 56 / 70

57 call by reference : main (3)... <--%ebp <--%esp0..%esp0.....%ebp0... <--%esp <-- %ebp..%ecx... 20bytes 12bytes..var....LFE3: Young W. Lim Stack Debugging Tue 57 / 70

58 call by reference : func1 (1)-a func1:.lfb2: pushl %ebp ;; push %ebp, %esp -= 4 movl %esp, %ebp ;; %ebp = %esp subl $40, %esp ;; %esp -= 40 movl %gs:20, %eax ;; %eax = [%gs:20] movl %eax, -12(%ebp) ;; [%ebp-12] = %eax xorl %eax, %eax ;; %eax = 0 movl $ , -26(%ebp) ;; [%ebp-26] = "lleh" movl $ , -22(%ebp) ;; [%ebp-22] = "w,o" movl $ , -18(%ebp) ;; [%ebp-18] = "dlro" movw $33, -14(%ebp) ;; [%ebp-14] =! subl $12, %esp ;; %esp -= 12 leal -26(%ebp), %eax ;; %eax = %ebp-26 pushl %eax ;; push %eax, %esp -= 4 Young W. Lim Stack Debugging Tue 58 / 70

59 call by reference : func1 (1)-b func1:.lfb2: push %ebp, %esp -= 4 function prologue %ebp = %esp %esp -= 40 allocate 40 bytes for local variables %eax = [%gs:20]. for checking the stack contamination [%ebp-12] = %eax. save [%gs:20] at [%ebp-12] %eax = 0. [%ebp-26] = "lleh" the string "Hello, world!" (13-byte) [%ebp-22] = "w,o" from [%ebp-14] to [%ebp-26] [%ebp-18] = "dlro" High add Low add [%ebp-14] =!! d l r o w, o l l e H %esp -= 12 allocate space for the function call %eax = %ebp-26 address of the start of the string push %eax, %esp -= 4 the 1st argument on the stack Young W. Lim Stack Debugging Tue 59 / 70

60 call by reference : func1 (2)-a.L5:.LFE2:... call func2 ;; func2( str ); addl $16, %esp ;; %esp += 16 nop movl -12(%ebp), %eax ;; %eax = [%ebp-12] xorl %gs:20, %eax ;; %eax ^= %gs:20 je.l5 ;; if!%eax, jump... call stack_chk_fail leave ret char str[] = "Hello, world!"; $ x6C6C6548 lleh $ x77202C6F w,o $ x646C726F dlro Young W. Lim Stack Debugging Tue 60 / 70

61 call by reference : func1 (2)-b func2( str ); %esp += 16 %eax = [%ebp-12] %eax ^= %gs:20 function call deallocates the space for the function call. check the stack contamination. xor result = 1 means contamination Young W. Lim Stack Debugging Tue 61 / 70

62 call by reference : func2 (1)-a func2:.lfb1: pushl %ebp ;; push %ebp %esp -= 4; movl %esp, %ebp ;; %ebp = %esp subl $40, %esp ;; %esp -= 40 movl 8(%ebp), %eax ;; %eax = [%ebp+8] movl %eax, -28(%ebp) ;; [%ebp-28] = %eax movl %gs:20, %eax ;; %eax = %gs:20 movl %eax, -12(%ebp) ;; [%ebp-12] = %eax xorl %eax, %eax ;; %eax = 0 movl $1, -16(%ebp) ;; [%ebp-16] = 1 ;; int i = 1; subl $12, %esp ;; %esp -= 12 leal -16(%ebp), %eax ;; %eax = %ebp-16 pushl %eax ;; push %eax %esp -= 4... Young W. Lim Stack Debugging Tue 62 / 70

63 call by reference : func2 (1)-b func2:.lfb1: push %ebp, %esp -= 4; function prologue %ebp = %esp %esp -= 40 allocate 40 bytes for local variables %eax = [%ebp+8] 1st arg - add of the start of the string [%ebp-28] = %eax stored 1st arg - never used %eax = %gs:20. for checking the stack contamination [%ebp-12] = %eax. save [%gs:20] at [%ebp-12] %eax = 0. [%ebp-16] = 1 ;; int i = 1; initialize the local variable i %esp -= 12 allocate space for the function call %eax = %ebp-16 the address of the local variable i push %eax, %esp -= 4 the 1st argument on the stack... Young W. Lim Stack Debugging Tue 63 / 70

64 call by reference : func2 (2)-a.L3:.LFE1: call func3 ;; func3( &i ); addl $16, %esp ;; %esp += 16 movl -16(%ebp), %eax ;; %eax = [%ebp-16] subl $8, %esp ;; %esp -= 8 pushl %eax ;; push %eax, %esp -= 4 pushl $.LC3 ;; push addr(.lc3), %esp -= 4... call printf ;; printf("i = %d \n", i); addl $16, %esp ;; %esp += 16 nop movl -12(%ebp), %eax ;; %eax = [%ebp-12] xorl %gs:20, %eax ;; %eax ^= %gs:20 je.l3... call stack_chk_fail leave ret Young W. Lim Stack Debugging Tue 64 / 70

65 call by reference : func2 (2)-b push %ebp %esp -= 4 function prologue func3( &i ); function call %esp += 16 deallocate the space for the local variables %eax = [%ebp-16] local variable in terms of %ebp %esp -= 8 allocate the space for the functon call push %eax, %esp -= 4 return value in %eax is the 1st arg push addr(.lc3), %esp -= 4 format string is the 2nd arg printf("i = %d \n", i); %esp += 16 %eax = [%ebp-12] %eax ^= %gs:20 deallocate the space for the function call. check the stack contamination. xor result = 1 means contamination Young W. Lim Stack Debugging Tue 65 / 70

66 call by reference : func3 (1) func3:.lfb0: pushl %ebp ;; push %ebp, %esp -= 4 movl %esp, %ebp ;; %ebp = %esp subl $24, %esp ;; %esp -= 24 movl $0, -12(%ebp) ;; [%ebp-12] = 0 ;; int c = \0 ;... call getpid ;; getpid() subl $8, %esp ;; %esp -= 8 pushl %eax ;; push %eax, %esp -= 4 pushl $.LC0 ;; push addr(.lc0), %esp -= 4... call printf ;; printf("pid = %d; ", getpid()); addl $16, %esp ;; %esp += 16 subl $12, %esp ;; %esp -= 12 pushl $.LC1 ;; push addr(.lc1), %esp -=4... Young W. Lim Stack Debugging Tue 66 / 70

67 call by reference : func3 (2).LFE0: call puts ;; printf("press <Enter> \n"); addl $16, %esp ;; %esp += 16 movl stdin, %eax ;; %eax = stdin subl $12, %esp ;; %esp -= 12 pushl %eax ;; push %eax, %esp -= 4... call fgetc ;; c = fgetc( stdin ); addl $16, %esp ;; %esp -= 16 movl %eax, -12(%ebp) ;; [%ebp-12] = %eax subl $8, %esp ;; %esp -= 8 pushl -12(%ebp) ;; push [%ebp-12], %esp -= 12 pushl $.LC2 ;; push addr(.lc2), %esp -= 4... call printf ;; printf("c=%c\n", c); addl $16, %esp ;; %esp += 16 movl 8(%ebp), %eax ;; %eax = [%ebp+8] ;; *a = 9; movl $9, (%eax) ;; %eax = 9 nop leave ret Young W. Lim Stack Debugging Tue 67 / 70

68 Linux Stack Protector %gs:20 (1) 1 Stack protector works by putting predefined pattern at the start of the stack frame and verifying that it hasn t been overwritten when returning from the function. The pattern is called stack canary and unfortunately gcc requires it to be at a fixed offset from %gs. On x86_64, the offset is 40 bytes and on x86_32 20 bytes. x86_64 and x86_32 use segment registers differently and thus handles this requirement differently. On x86_64, %gs is shared by percpu area and stack canary. All percpu symbols are zero based and %gs points to the base of percpu area. The first occupant of the percpu area is always irq_stack_union which contains stack_canary at offset 40. Userland %gs is always saved and restored on kernel entry and exit using swapgs, so stack protector doesn t add any complexity there. Young W. Lim Stack Debugging Tue 68 / 70

69 Linux Stack Protector %gs:20 (2) 1 On x86_32, it s slightly more complicated. As in x86_64, %gs is used for userland TLS. Unfortunately, some processors are much slower at loading segment registers with different value when entering and leaving the kernel, so the kernel uses %fs for percpu area and manages %gs lazily so that %gs is switched only when necessary, usually during task switch. As gcc requires the stack canary at %gs:20, %gs can t be managed lazily if stack protector is enabled, so the kernel saves and restores userland %gs on kernel entry and exit. This behavior is controlled by CONFIG_X86_32_LAZY_GS and accessors are defined in system.h to hide the details. Young W. Lim Stack Debugging Tue 69 / 70

70 Linux Stack Protector %gs:20 (3) 1 - putting predefined pattern at the start of the stack frame - verifying that it hasn t been overwritten when returning - stack canary - a fixed offset from %gs (gcc) - 40 bytes for x86_64-20 bytes for x86 - segment reg %gs Young W. Lim Stack Debugging Tue 70 / 70