Stack Debugging. Young W. Lim Mon. Young W. Lim Stack Debugging Mon 1 / 63

Transcription

1 Stack Debugging Young W. Lim Mon Young W. Lim Stack Debugging Mon 1 / 63

2 Outline 1 Based on 2 Introduction Compiling to IA32 Assembly Checking /proc/<pid>/maps file Checking the main stack frame 3 Stack Frames Using gdb Stack Frame Pointers Functions and Stack Frames 4 Calling Convention Function Call and Return Enter and Leave Instructions Function Prologue and Epilogue example codes and output results handling arguments and return value analyzing func2() analyzing func1() analyzing Young W. Limmain() Stack Debugging Mon 2 / 63

3 Based on "Self-service Linux: Mastering the Art of Problem Determination", Mark Wilding "Computer Architecture: A Programmer s Perspective", Bryant & O Hallaron I, the copyright holder of this work, hereby publish it under the following licenses: GNU head Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled GNU Free Documentation License. CC BY SA This file is licensed under the Creative Commons Attribution ShareAlike 3.0 Unported License. In short: you are free to share and make derivative works of the file under the conditions that you appropriately attribute it, and that you distribute it only under a license compatible with this one. Young W. Lim Stack Debugging Mon 3 / 63

4 preparation : for Linux Mint install packages lib32gcc1 lib32gcc-dbg gcc-multilib gcc -m32 t.c Young W. Lim Stack Debugging Mon 4 / 63

5 stack frame address range stack frame starts from 0xc stack bottom : 0xc stack address range 0xbfffe000 (low address) 0xc (high address) stack grows toward lower address from HIGH address (0xc ) to LOW address (0xbfffe000) Young W. Lim Stack Debugging Mon 5 / 63

6 stack frame in the Linux Mint stack address range 0xc (from HIGH address) 0xbfffe000 (to LOW address) 0x stack address range in the Linux Mint 0xfffc9000 (from HIGH address) 0xfffa8000 (to LOW address) 0x these addresses are not fixed Young W. Lim Stack Debugging Mon 6 / 63

7 code for displaying /proc/<pid>/maps local variables (stack variables) : var local variable address : 0xff9e00e8 #include <stdio.h> #include <sys/types.h> #include <unistd.h> #include <stdlib.h> int main(int argc, char *argv[]) { int var = 5; char cmd[64]; } printf(" &var = %p\n", &var ); sprintf(cmd, "cat /proc/%d/maps", getpid()); system(cmd); Young W. Lim Stack Debugging Mon 7 / 63

8 result for displaying /proc/<pid>/maps &var = 0xff9e00e r-xp : /home/young/a.out a000 r--p : /home/young/a.out 0804a b000 rw-p : /home/young/a.out 0851b c000 rw-p :00 0 [heap] f75fb000-f75fc000 rw-p :00 0 f75fc000-f77a9000 r-xp : /lib32/libc-2.23.so f77a9000-f77aa p 001ad000 08: /lib32/libc-2.23.so f77aa000-f77ac000 r--p 001ad000 08: /lib32/libc-2.23.so f77ac000-f77ad000 rw-p 001af000 08: /lib32/libc-2.23.so f77ad000-f77b1000 rw-p :00 0 f77ce000-f77d0000 r--p :00 0 [vvar] f77d0000-f77d2000 r-xp :00 0 [vdso] f77d2000-f77f4000 r-xp : /lib32/ld-2.23.so f77f4000-f77f5000 rw-p :00 0 f77f5000-f77f6000 r--p : /lib32/ld-2.23.so f77f6000-f77f7000 rw-p : /lib32/ld-2.23.so ff9c1000-ff9e2000 rw-p :00 0 [stack] Young W. Lim Stack Debugging Mon 8 / 63

9 fields in /proc/<pid>/maps (from 1 ) address: the address space in the process that it occupies perms: a set of permissions offset: the offset into the mapping dev: the device (major:minor) inode: the inode on that device. pathname: shows the name associated file for this mapping address perms offset dev inode pathname fffa8000-fffc9000 rw-p :00 0 [stack] (1) ff9c1000-ff9e2000 rw-p :00 0 [stack] (2) 1 how-to-identify-stack-and-heap-segments-in-proc-pid-maps-file Young W. Lim Stack Debugging Mon 9 / 63

10 perms & inode fields perms: a set of permissions r = read w = write x = execute s = shared p = private (copy on write) inode: the inode on that device. 0 indicates that no inode is associated with the memory region like BSS (uninitialized data) Young W. Lim Stack Debugging Mon 10 / 63

11 pathname field pathname If the mapping is associated with a file: the name of the associated file for this mapping If the mapping is not associated with a file: [heap] = the heap of the program [stack] = the stack of the main process [stack:1001] = the stack of the thread with tid 1001 [vdso] = the "virtual dynamic shared object", the kernel system call handler empty = the mapping is anonymous. Young W. Lim Stack Debugging Mon 11 / 63

12 stack elements in /proc/<pid>/maps file addr(stack_var) = 0xff9200e8 address perms offset dev inode pathname ff9c1000-ff9e2000 rw-p :00 0 [stack] [from HIGH] ff9e2000 V ff9e00e8 : &var V [to LOW ] ff9c1000 Young W. Lim Stack Debugging Mon 12 / 63

13 ELF stack contents [from HIGH] ff9e stack bottom 1 path name specified in exec() 2 environment variables 3 argv strings 4 argc 5 aux vectors [from HIGH] ff9e2000 1, 2, 3, 4, 5 V ff9e00e8 : &var [to LOW ] ff9c1000 Young W. Lim Stack Debugging Mon 13 / 63

14 code for checking the main stack frame (1) #include <stdio.h> #include <sys/types.h> #include <unistd.h> #include <stdlib.h> extern char **environ; int main(int argc, char *argv[]) { int var = 5; char cmd[64]; printf(" *environ = %p\n", *environ ); printf("1. argv[0] = %p\n", argv[0] ); printf("2. environ = %p\n", environ ); printf("3. argv = %p\n", argv ); printf("4. &argc = %p\n", &argc ); printf(" &var = %p\n", &var); Young W. Lim Stack Debugging Mon 14 / 63

15 code for checking the main stack frame (2) printf(" *environ = %s\n", *environ ); printf("1. argv[0] = %s\n", argv[0] ); printf("2. *environ = %p\n", *environ ); printf("3. *argv = %p\n", *argv ); printf("4. argc = %d\n", argc ); printf(" var = %d\n", var); sprintf(cmd, "cat /proc/%d/maps", getpid()); system(cmd); return 0; } Young W. Lim Stack Debugging Mon 15 / 63

16 results for the main stack frame (1)... 0xffcc [from HIGH] *environ = 0xffce938b 1. argv[0] = 0xffce environ = 0xffce866c 3. argv = 0xffce &argc = 0xffce85d0 &var = 0xffce8568 V... 0xffcea000...[to LOW ] *environ = LC_PAPER=ko_KR.UTF-8 1. argv[0] =./a.out 2. *environ = 0xffce938b 3. *argv = 0xffce argc = 1 var = 5 Young W. Lim Stack Debugging Mon 16 / 63

17 results for the main stack frame (2) r-xp : /home/young/a.out a000 r--p : /home/young/a.out 0804a b000 rw-p : /home/young/a.out 08ca cc4000 rw-p :00 0 [heap] f75fd000-f75fe000 rw-p :00 0 f75fe000-f77ab000 r-xp : /lib32/libc-2.23.so f77ab000-f77ac p 001ad000 08: /lib32/libc-2.23.so f77ac000-f77ae000 r--p 001ad000 08: /lib32/libc-2.23.so f77ae000-f77af000 rw-p 001af000 08: /lib32/libc-2.23.so f77af000-f77b3000 rw-p :00 0 f77d0000-f77d2000 r--p :00 0 [vvar] f77d2000-f77d4000 r-xp :00 0 [vdso] f77d4000-f77f6000 r-xp : /lib32/ld-2.23.so f77f6000-f77f7000 rw-p :00 0 f77f7000-f77f8000 r--p : /lib32/ld-2.23.so f77f8000-f77f9000 rw-p : /lib32/ld-2.23.so ffcc9000-ffcea000 rw-p :00 0 [stack] Young W. Lim Stack Debugging Mon 17 / 63

18 using gdb to check stack frames use gdb break func3 run backtrace main() -> func1() -> func2() -> func3() var str i c 3 "Hello, world!" 1 \ #3 #2 #1 #0 Young W. Lim Stack Debugging Mon 18 / 63

19 example code #include <stdio.h> #include <unistd.h> void func3( int *a ) { int c = \0 ; printf("pid = %d; ", getpid()); printf("press <Enter> \n"); c = fgetc( stdin ); void func2( char *s ) { int i = 1; func3( &i ); printf("i = %d \n", i); } void func1( int m ) { char str[] = "Hello, world!"; func2( str ); } } printf("c=%c\n", c); *a = 9; int main(void) { int var = 3; func1( var ); return 0; } Young W. Lim Stack Debugging Mon 19 / 63

20 gdb commands gdb a.out ---> GNU gdb (Ubuntu ubuntu1~16.04) Copyright (C) 2016 Free Software Foundation, Inc.... (gdb) break func3 Punto de interrupción 1 at 0x : file t.c, line 7. (gdb) run Starting program: /home/young/a.out Breakpoint 1, func3 (a=0xffffd068) at t.c:7 7 int c = \0 ; (gdb) backtrace #0 func3 (a=0xffffd068) at t.c:7 #1 0x080485ab in func2 (s=0xffffd09e "Hello, world!") at t.c:19 #2 0x e in func1 (m=3) at t.c:26 #3 0x in main () at t.c:32 (gdb) Young W. Lim Stack Debugging Mon 20 / 63

21 gdb stack frame numbering [from HIGH] - stack bottom 1 main() - gdb #3 2 func1() - gdb #2 3 func2() - gdb #1 4 func3() - gdb #0 break point #0 func3 (a=0xffffd068) at t.c:7 #1 0x080485ab in func2 (s=0xffffd09e "Hello, world!") at t.c:19 #2 0x e in func1 (m=3) at t.c:26 #3 0x in main () at t.c:32 Young W. Lim Stack Debugging Mon 21 / 63

22 Stack frame pointers (1) Full Downward Stack BP_old old stack frame V... SP_old BP_new new stack frame V... SP_new pushl movl subl %ebp %esp, %ebp $16, %esp Young W. Lim Stack Debugging Mon 22 / 63

23 Stack frame pointers (2) BP_old old stack frame V... SP_old BP_new new stack frame V... SP_new - old BP must be saved on the stack - pushl %ebp - stack grows downward - decreasing new SP for manual push operation BP_old old stack frame V [BP_old] SP_old BP_new new stack frame V [xxxxx]... SP_new pushl movl subl %ebp %esp, %ebp $16, %esp Young W. Lim Stack Debugging Mon 23 / 63

24 c source code #include <stdio.h> void func1( int m ) { int i = 99; } int main(void) { int i = 3; gcc -m32 -S -Wall t.c t.c -> t.s t.c func1( i ); return 0; } Young W. Lim Stack Debugging Mon 24 / 63

25 generated assembly (1).file.text.globl.type "t.c" func1 func1:.lfb0:.lfe0:.cfi_startproc pushl %ebp.cfi_def_cfa_offset 8.cfi_offset 5, -8 movl %esp, %ebp.cfi_def_cfa_register 5 subl $16, %esp movl $99, -4(%ebp) nop leave.cfi_restore 5.cfi_def_cfa 4, 4 ret.cfi_endproc.size.globl.type func1,.-func1 main Young W. Lim Stack Debugging Mon 25 / 63

26 generated assembly (2) main:.lfb1:.lfe1:.cfi_startproc pushl %ebp.cfi_def_cfa_offset 8.cfi_offset 5, -8 movl %esp, %ebp.cfi_def_cfa_register 5 subl $16, %esp movl $3, -4(%ebp) pushl -4(%ebp) call func1 addl $4, %esp movl $0, %eax leave.cfi_restore 5.cfi_def_cfa 4, 4 ret.cfi_endproc.size main,.-main.ident "GCC: (Ubuntu ubuntu1~ ).section.note.GNU-stack,"",@progbits Young W. Lim Stack Debugging Mon 26 / 63

27 func1() analysis func1:.lfb0:.lfe0: function prologue pushl %ebp movl %esp, %ebp subl $16, %esp movl $99, -4(%ebp) nop function epilogue leave ret void func1( int m ) { // the local stack variable // stored at %ebp-4 int i = 99; } Young W. Lim Stack Debugging Mon 27 / 63

28 main() analysis main:.lfb1:.lfe1: function prologue pushl %ebp movl %esp, %ebp subl $16, %esp movl $3, -4(%ebp) pushl -4(%ebp) call func1 addl $4, %esp movl $0, %eax function epilogue leave ret int main(void) { // local stack variable // at %ebp-4 int i = 3; // the argument $3 // the value at %ebp-4 // pushed on the stack // before calling func1() func1( i ); // return value $0 // is stored in %eax return 0; } Young W. Lim Stack Debugging Mon 28 / 63

29 Omitting frame pointer compiler option -fomit-frame-pointer -fno-omit-frame-pointer Young W. Lim Stack Debugging Mon 29 / 63

30 Function Call 1 push the return address (%esp -= 4, then push %eip) 2 jump to the start of the called function return address the address of the instruction immediately following the call instruction - Direct call : call label - Indirect call : call *operand operand : - offset Imm - a base register Eb - an index register Ei - a scalefactor s Young W. Lim Stack Debugging Mon 30 / 63

31 Function Return 1 pops the return address from the stack 2 jump to the return address location the SP must points to the location where the correct return address can be stored leave instruction does this stack preparation Young W. Lim Stack Debugging Mon 31 / 63

32 enter instruction prepares the stack frame for entering to the callee equivalent instructions as follows - push the current %ebp - new %ebp points where this old %ebp is saved - the last stack content is this savd %ebp - the 2nd last stack content is the return address (^) push %ebp ;; push the old %ebp mov %esp %ebp ;; new %ebp = the old %esp... <--%ebp <--%esp0..r.addr.. %ebp0 <--%esp <-- %ebp Young W. Lim Stack Debugging Mon 32 / 63

33 leave instruction prepares the stack frame for returning to the caller equivalent instructions as follows - current %esp points where the old %ebp was saved - restore %ebp by this saved old %ebp - the last stack content is the saved old %ebp - the 2nd last stack content is the return address (^) movl %ebp, %esp pop %ebp ;; restored %esp1 = the current %ebp ;; restored %ebp1 = the saved old %ebp <--%ebp0 <--%ebp r.addr.. <--%esp1 %ebp0 <-- %ebp %ebp0 <--%esp Young W. Lim Stack Debugging Mon 33 / 63

34 Function Prologue 1 pushl %ebp stores the BP (base pointer) of the previous frame on the stack decrements SP by 4 bytes (long: 32bits) 2 movl %esp, %ebp updates the BP (base pointer) with the SP (stack pointer) BP always points to the current stack bottom (higher address) SP always points to the current stack top (lower address) SP always points to full (non-empty) word 3 subl $16, %esp to push the local variable i (int, 4 bytes) stack grows downward SP points 4 bytes lower address 16-byte alignment Young W. Lim Stack Debugging Mon 34 / 63

35 Function Epilogue 1 leave movl %ebp, %esp popl %ebp 2 ret function prologue pushl %ebp movl %esp, %ebp old BP stored on the stack old SP becomes new BP new BP points to the stored old BP function epilogue movl %ebp, %esp popl %ebp current BP points to the stored old BP this BP becomes new SP take the stored old BP Young W. Lim Stack Debugging Mon 35 / 63

36 example C codes for checking the X86 calling convention int func2( int i, int j, int k ) { int val = i+j+k; main() --> func1() --> func2() val val val 0 0 i+j+k func1(a) func2(b,c,d)... #include <stdio.h> #define A 1 #define B 2 #define C 3 #define D 4 return val; } int func1( int m ) { int val = 0; val = func2( B, C, D ); return val; } int main(void) { int val = 0; val = func1( A ); return val; } Young W. Lim Stack Debugging Mon 36 / 63

37 checking calling convention - generated assembly (1).file "t.c".text....globl func2.type func2: [AAA].size func2,.-func2....globl func1.type func1: [BBB].size func1,.-func1....globl main.type main: [CCC].size main,.-main....ident "GCC:....section... func2: [AAA].LFB0: [[ func2 ]].LFE0: func1: [BBB].LFB1: [[ func1 ]].LFE1: main: [CCC].LFB2: [[ main ]].LFE2: Young W. Lim Stack Debugging Mon 37 / 63

38 checking calling convention - generated assembly (2) func2: [AAA].LFB0:.cfi_startproc pushl %ebp.cfi_def_cfa_offset 8.cfi_offset 5, -8 movl %esp, %ebp.cfi_def_cfa_register 5 subl $16, %esp movl 8(%ebp), %edx movl 12(%ebp), %eax addl %eax, %edx movl 16(%ebp), %eax addl %edx, %eax movl %eax, -4(%ebp) movl -4(%ebp), %eax leave.cfi_restore 5.cfi_def_cfa 4, 4 ret.cfi_endproc.lfe0 func1: [BBB].LFB1:.cfi_startproc pushl %ebp.cfi_def_cfa_offset 8.cfi_offset 5, -8 movl %esp, %ebp.cfi_def_cfa_register 5 subl $16, %esp movl $0, -4(%ebp) pushl $4 pushl $3 pushl $2 call func2 addl $12, %esp movl %eax, -4(%ebp) movl -4(%ebp), %eax leave.cfi_restore 5.cfi_def_cfa 4, 4 ret.cfi_endproc.lfe1: Young W. Lim Stack Debugging Mon 38 / 63

39 checking calling convention - generated assembly (3) main:.lfb2: [CCC].cfi_startproc pushl %ebp.cfi_def_cfa_offset 8.cfi_offset 5, -8 movl %esp, %ebp.cfi_def_cfa_register 5 subl $16, %esp movl $0, -4(%ebp) pushl $1 call func1 addl $4, %esp movl %eax, -4(%ebp) movl -4(%ebp), %eax leave.cfi_restore 5.cfi_def_cfa 4, 4 ret.cfi_endproc.lfe2: Young W. Lim Stack Debugging Mon 39 / 63

40 pushing arguments on to the stack frame storing arguments onto the stack from the right to the left in the reverse order the first argument is save at the last func(a, B, C, D); < push D -> push C -> push B -> push A Young W. Lim Stack Debugging Mon 40 / 63

41 storing return value to %eax regsiter store the return value in the %eax register movl leave ret -4(%ebp), %eax stack grows downward %ebp : BP %ebp-4 : 4 bytes downward from BP the word at %ebp-4 is moved to %eax a local stack variable is stored here its value is the return value the old BP is stored at %ebp Young W. Lim Stack Debugging Mon 41 / 63

42 1. analyzing func2() - (1) func2:.lfb0: pushl %ebp movl %esp, %ebp subl $16, %esp movl 8(%ebp), %edx movl 12(%ebp), %eax addl %eax, %edx movl 16(%ebp), %eax addl %edx, %eax movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret int func2( int i, int j, int k ) { int val = i+j+k; return val; } main() -> func1() -> func2() - just after func2() is called - %ebp & %esp of the caller func1() - [old %ebp] %ebp of main() %ebp - 0 : [old %ebp] <-- %ebp %ebp - 4 : $0 %ebp - 8 : $4 %ebp - c : $3 %ebp -10 : $2 %ebp -14 : [Ret address] <-- %esp Young W. Lim Stack Debugging Mon 42 / 63

43 1. analyzing func2() - (2) func2:.lfb0: pushl %ebp movl %esp, %ebp subl $16, %esp movl 8(%ebp), %edx movl 12(%ebp), %eax addl %eax, %edx movl 16(%ebp), %eax addl %edx, %eax movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret - after function prolog is executed - [old %ebp] %ebp of func1() %ebp - 4 : $0 %ebp - 8 : $4 %ebp+10 %ebp - c : $3 %ebp+c %ebp -10 : $2 %ebp+8 %ebp -14 : [Ret address] %ebp+4 %ebp -18 : [old %ebp] <-- %esp <-- %ebp - just before leave %ebp +14 : $0 %ebp +10 : $4 %ebp + c : $3 %ebp + 8 : $2 %ebp + 4 : [Ret address] %ebp %ebp - 4 : [val]... %ebp -10 : : [old %ebp] <-- %ebp <-- %esp Young W. Lim Stack Debugging Mon 43 / 63

44 2. analyzing func1() - (1) func1:.lfb1: pushl %ebp movl %esp, %ebp subl $16, %esp movl $0, -4(%ebp)... pushl $4 pushl $3 pushl $2... call func2 addl $12, %esp movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret.lfe1: #define B 2 #define C 3 #define D 4 int func1( int m ) { int val = 0; val = func2( B, C, D ); return val; } - push arguements on the stack - from the right argument - to the left argument - just after executing the function prologue %ebp - 0 : [old %ebp] <-- %ebp <= %esp %ebp - 4 : %ebp - 8 : %ebp - c : %ebp -10 : <-- %esp <= %esp-16 Young W. Lim Stack Debugging Mon 44 / 63

45 2. analyzing func1() - (2) func1:.lfb1: pushl %ebp movl %esp, %ebp subl $16, %esp movl $0, -4(%ebp)... pushl $4 pushl $3 pushl $2... call func2 addl $12, %esp movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret.lfe1: - just after call func2 - call instruction pushes the return address on the stack %ebp - 4 : $0 (init val) %esp+10 %ebp - 8 : $4 %esp+c %ebp - c : $3 %esp+8 %ebp -10 : $2 %esp+4 %ebp +14 : [ret addr] <-- %esp - just after ret from func2 - ret instruction pops the return address from the stack %ebp - 4 : [updated val] %esp+c %ebp - 8 : $4 %esp+8 %ebp - c : $3 %esp+4 %ebp -10 : $2 <-- %esp Young W. Lim Stack Debugging Mon 45 / 63

46 2. analyzing func1() - (3) func1:.lfb1: pushl %ebp movl %esp, %ebp subl $16, %esp movl $0, -4(%ebp)... pushl $4 pushl $3 pushl $2... call func2 addl $12, %esp movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret.lfe1: - after returning from func2() decrease stack by 12 bytes - the SP now points to the stack variable val - the return value from func2 in %eax - val is updated with this return value - this value is stored to %eax the return value of func1() %ebp - 4 : XX <-- %esp %ebp - 8 : $4 %ebp - c : $3 %ebp -10 : $2 Young W. Lim Stack Debugging Mon 46 / 63

47 3. analyzing main() - (1) main:.lfb2: pushl %ebp movl %esp, %ebp subl $16, %esp movl $0, -4(%ebp)... pushl $1... call func1 addl $4, %esp movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret.lfe2: #define A 1 int main(void) { int val = 0; val = func1( A ); return val; } - just after executing the function prologue %ebp - 0 : [old %ebp] <-- %ebp <= %esp %ebp - 4 : %ebp - 8 : %ebp - c : %ebp -10 : <-- %esp <= %esp-16 Young W. Lim Stack Debugging Mon 47 / 63

48 3. analyzing main() - (2) main:.lfb2: pushl %ebp movl %esp, %ebp subl $16, %esp movl $0, -4(%ebp)... pushl $1... call func1 addl $4, %esp movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret.lfe2: - just after call func1 - call instruction pushes the return address on the stack %ebp - 4 : $0 (init val) %esp+14 %ebp - 8 : %esp+10 %ebp - c : %esp+c %ebp -10 : %esp+8 %ebp +14 : $1 %esp+4 %ebp +18 : [ret addr] <-- %esp - just after ret from func1 - ret instruction pops the return address from the stack %ebp - 4 : $0 (init val) %esp+10 %ebp - 8 : %esp+c %ebp - c : %esp+8 %ebp -10 : %esp+4 %ebp +14 : $1 <-- %esp } Young W. Lim Stack Debugging Mon 48 / 63

49 3. analyzing main() - (3) main:.lfb2: pushl %ebp movl %esp, %ebp subl $16, %esp movl $0, -4(%ebp)... pushl $1... call func1 addl $4, %esp movl %eax, -4(%ebp)... movl -4(%ebp), %eax leave ret.lfe2: - after returning from func1() decrease stack by 4 bytes - the return value from func2 in %eax - val is updated with this return value - this value is stored to %eax the return value of main %ebp - 4 : XX %ebp - 8 : %ebp - c : %ebp -10 : } <-- %esp Young W. Lim Stack Debugging Mon 49 / 63

50 call by reference example code #include <stdio.h> #include <unistd.h> void func3( int *a ) { int c = \0 ; printf("pid = %d; ", getpid()); printf("press <Enter> \n"); c = fgetc( stdin ); void func2( char *s ) { int i = 1; func3( &i ); printf("i = %d \n", i); } void func1( int m ) { char str[] = "Hello, world!"; func2( str ); } } printf("c=%c\n", c); *a = 9; int main(void) { int var = 3; func1( var ); return 0; } Young W. Lim Stack Debugging Mon 50 / 63

51 example code summary main( ) {local: var=3} func1(var) func1( m ) {local: str[]="hello, world!"} func2(str) func2( *s ) {local: i=1} func3(&i) print i func3( *a ) {local: c= \0 } print pid & Press <Enter> c=fgetc(stdin) print c *a=9 Young W. Lim Stack Debugging Mon 51 / 63

52 call by reference : generated assembly structure.lc3:.string "i = %d \n".file "t.c".text.section.rodata.globl func2.lc0:.type "pid = %d; " func2:....lc1:.size func2,.-func2.string "Press <Enter> ".globl func1.lc2:.type "c=%c\n" func1:....text.size func1,.-func1.globl func3.globl main.type func3:... main:....size func3,.-func3.size main,.-main.section.rodata.ident "GCC: (Ubuntu ubuntu1~.section.note.GNU-stack,"",@p Young W. Lim Stack Debugging Mon 52 / 63

53 call by reference : printf string constants.lc0:.lc1:.lc2:.lc3:.string "pid = %d; ".string "Press <Enter> ".string "c=%c\n".string "i = %d \n" void func3( int *a ) {... printf("pid = %d; ", getpid()); printf("press <Enter> \n");... printf("c=%c\n", c);... } void func2( char *s ) {... printf("i = %d \n", i); } Young W. Lim Stack Debugging Mon 53 / 63

54 call by reference : main (1) main:.lfb3:.lfe3: leal 4(%esp), %ecx ;; %ecx = %esp+4 andl $-16, %esp ;; 0xFFFFFFF0 pushl -4(%ecx) ;; push [%ecx-4] %esp -= 4 pushl %ebp ;; push %ebp %esp -= 4 movl %esp, %ebp ;; %ebp = %esp pushl %ecx ;; push %ecx %esp -= 4 subl $20, %esp ;; %esp -= 20 movl $3, -12(%ebp) ;; [%ebp-12] = 3 ;; int var = 3; subl $12, %esp ;; %esp -= 12 pushl -12(%ebp) ;; push [%ebp-12]... call func1 ;; func1( var ); addl $16, %esp ;; %esp += 16 movl $0, %eax ;; %eax = 0 ;; return 0; movl -4(%ebp), %ecx ;; %ecx = [%ebp-4] leave ;; %esp = %ebp pop %ebp leal -4(%ecx), %esp ;; %esp = %ecx-4 ret Young W. Lim Stack Debugging Mon 54 / 63

55 call by reference : main (2) main:.lfb3: %ecx = %esp+4 %ecx= init %esp+4 0xFFFFFFF0 16-byte alignment of %esp push [%ecx-4] %esp -= 4 push init %esp %esp -= 4 push %ebp %esp -= 4 push init %ebp %esp -= 4 %ebp = %esp new %ebp = %esp (aligned %esp-8) push %ecx %esp -= 4 push init %esp+4 %esp -= 4 %esp -= 20 enlarge %esp by 20 %esp -= 20 [%ebp-12] = 3 ;; int var = 3; (%ebp-12) = (%ecx) = (init %esp+4) %esp -= 12 enlarge %esp by 12 %esp -= 12 push [%ebp-12] push arg (=var) %exp -= 4 func1( var ); function call %esp += 16 contrict %esp by 16 %esp += 16 %eax = 0 ;; return 0; return value of main() = 0 %ecx = [%ebp-4] %esp = %ebp pop %ebp %esp = %ecx-4 ;; %ecx = init %esp+4 ;; 16-byte alignment %esp Young W. Lim Stack Debugging ;; %ebp = %esp Mon 55 / 63

56 call by reference : func1 (1) func1:.lfb2: call func2 ;; func2( str ); pushl %ebp ;; push %ebp %esp -= 4 movl %esp, %ebp ;; %ebp = %esp subl $40, %esp ;; %esp -= 40 movl %gs:20, %eax ;; %eax = [%gs:20] movl %eax, -12(%ebp) ;; [%ebp-12] = %eax xorl %eax, %eax ;; %eax = 0 movl $ , -26(%ebp) ;; [%ebp-26] = "lleh" movl $ , -22(%ebp) ;; [%ebp-22] = "w,o" movl $ , -18(%ebp) ;; [%ebp-18] = "dlro" movw $33, -14(%ebp) ;; [%ebp-14] =! subl $12, %esp ;; %esp -= 12 leal -26(%ebp), %eax ;; %eax = %ebp-26 pushl %eax ;; push %eax %esp -= 4 Young W. Lim Stack Debugging Mon 56 / 63

57 call by reference : func1 (2).L5:.LFE2:... call func2 ;; func2( str ); addl $16, %esp ;; %esp += 16 nop movl -12(%ebp), %eax ;; %eax = [%ebp-12] xorl %gs:20, %eax ;; %eax ^= %gs:20 je.l5... call stack_chk_fail leave ret char str[] = "Hello, world!"; $ x6C6C6548 lleh $ x77202C6F w,o $ x646C726F dlro Young W. Lim Stack Debugging Mon 57 / 63

58 call by reference : func2 (1) func2:.lfb1: pushl %ebp ;; push %ebp %esp -= 4; movl %esp, %ebp ;; %ebp = %esp subl $40, %esp ;; %esp -= 40 movl 8(%ebp), %eax ;; %eax = [%ebp+8] movl %eax, -28(%ebp) ;; [%ebp-28] = %eax movl %gs:20, %eax ;; %eax = %gs:20 movl %eax, -12(%ebp) ;; [%ebp-12] = %eax xorl %eax, %eax ;; %eax = 0 movl $1, -16(%ebp) ;; [%ebp-16] = 1 ;; int i = 1; subl $12, %esp ;; %esp -= 12 leal -16(%ebp), %eax ;; %eax = %ebp-16 pushl %eax ;; push %eax %esp -= 4... Young W. Lim Stack Debugging Mon 58 / 63

59 call by reference : func2 (2).L3:.LFE1: call func3 ;; func3( &i ); addl $16, %esp ;; %esp -= 16 movl -16(%ebp), %eax ;; %eax = [%ebp-16] subl $8, %esp ;; %esp -= 8 pushl %eax ;; push %eax %esp -= 4 pushl $.LC3 ;; push addr(.lc3) %esp -= 4... call printf ;; printf("i = %d \n", i); addl $16, %esp ;; %esp += 16 nop movl -12(%ebp), %eax ;; %eax = [%ebp-12] xorl %gs:20, %eax ;; %eax ^= %gs:20 je.l3... call stack_chk_fail leave ret Young W. Lim Stack Debugging Mon 59 / 63

60 call by reference : func3 (1) func3:.lfb0: pushl %ebp ;; push %ebp %esp -= 4 movl %esp, %ebp ;; %ebp = %esp subl $24, %esp ;; %esp -= 24 movl $0, -12(%ebp) ;; [%ebp-12] = 0 ;; int c = \0 ;... call getpid ;; getpid() subl $8, %esp ;; %esp -= 8 pushl %eax ;; push %eax %esp -= 4 pushl $.LC0 ;; push addr(.lc0) %esp -= 4... call printf ;; printf("pid = %d; ", getpid()); addl $16, %esp ;; %esp += 16 subl $12, %esp ;; %esp -= 12 pushl $.LC1 ;; push addr(.lc1) %esp -=4... Young W. Lim Stack Debugging Mon 60 / 63

61 call by reference : func3 (2).LFE0: call puts ;; printf("press <Enter> \n"); addl $16, %esp ;; %esp += 16 movl stdin, %eax ;; %eax = stdin subl $12, %esp ;; %esp -= 12 pushl %eax ;; push %eax %esp -= 4... call fgetc ;; c = fgetc( stdin ); addl $16, %esp ;; %esp -= 16 movl %eax, -12(%ebp) ;; [%ebp-12] = %eax subl $8, %esp ;; %esp -= 8 pushl -12(%ebp) ;; push [%ebp-12] %esp -= 12 pushl $.LC2 ;; push addr(.lc2) %esp -= 4... call printf ;; printf("c=%c\n", c); addl $16, %esp ;; %esp += 16 movl 8(%ebp), %eax ;; %eax = [%ebp+8] ;; *a = 9; movl $9, (%eax) ;; %eax = 9 nop leave ret Young W. Lim Stack Debugging Mon 61 / 63

62 Linux Stack Protector %gs:20 (1) 1 Stack protector works by putting predefined pattern at the start of the stack frame and verifying that it hasn t been overwritten when returning from the function. The pattern is called stack canary and unfortunately gcc requires it to be at a fixed offset from %gs. On x86_64, the offset is 40 bytes and on x86_32 20 bytes. x86_64 and x86_32 use segment registers differently and thus handles this requirement differently. On x86_64, %gs is shared by percpu area and stack canary. All percpu symbols are zero based and %gs points to the base of percpu area. The first occupant of the percpu area is always irq_stack_union which contains stack_canary at offset 40. Userland %gs is always saved and restored on kernel entry and exit using swapgs, so stack protector doesn t add any complexity there. On x86_32, it s slightly more complicated. As in x86_64, %gs is used for userland TLS. Unfortunately, some processors are much slower at loading segment registers with different value when entering and leaving the kernel, so the kernel uses %fs for percpu area and manages %gs lazily so that %gs is switched only when necessary, usually during task switch. As gcc requires the stack canary at %gs:20, %gs can t be managed lazily if stack protector is enabled, so the kernel saves and restores Younguserland W. Lim %gs on kernel entry Stack Debugging and exit. This behavior is Mon 62 / 63

63 Linux Stack Protector %gs:20 (2) 1 - putting predefined pattern at the start of the stack frame - verifying that it hasn t been overwritten when returning - stack canary - a fixed offset from %gs (gcc) - 40 bytes for x86_64-20 bytes for x86 - segment reg %gs Young W. Lim Stack Debugging Mon 63 / 63