CS642: Computer Security

Transcription

1 X86 Review Process Layout, ISA, etc. CS642: Computer Security Drew Davidson

2 From Last Week ACL- based permissions (UNIX style) Read, Write, execute can be restricted on users and groups Processes (usually) run with the permissions of the invoking user Example: passwd write /etc/shadow RUID: rist EUID: root

3 Processes are the front line of system security Control a process and you get the privileges of its UID So how do you control a process? Send specially formed input to process input passwd write /etc/shadow RUID: rist EUID: root

4 Roadmap Today Enough x86 to understand (some) process vulnerabiliues Next Time Live demo of an avack How such avacks occur

5 Why do we need to look at assembly? WYSINWYX: What you see is not what you execute [Balakrishnan and Reps TOPLAS 2010] VulnerabiliUes exploited in this form We understand code in this form int foo(){ int a = 0; return a + 7; } Compiler pushl %ebp movl %esp, %ebp subl $16, %esp movl $0, -4(%ebp) movl -4(%ebp), %eax addl $7, %eax leave ret

6 x86: Popular but crazy CISC (complex instrucuon set compuung) Over 100 disunct opcodes in the set Register poor Only 8 registers of 32- bits, only 6 are general- purpose Variable- length instrucuons Built of many backwards- compauble revisions Many security problems preventable in hindsight

7 A LiVle History Intel avempts to trademark the number 486, gets denied Science- y?

8 Process memory layout.text.data.bss heap unused stack Env Low memory addresses Grows upward Grows downward High memory addresses.text Machine code of executable.data Global iniualized variables.bss Below Stack SecUon global uniniualized heap Dynamic variables stack Local variables FuncUon call data Env Environment variables Program arguments

9 Registers 32 bits EAX AX AH AL EBX BX BH BL ECX CX CH CL EDX DX DH DL ESI EDI ESP (stack pointer) EBP (base pointer)

10 InstrucUon Syntax Examples: subl $16, %ebx movl (%eax), %ebx InstrucUon ends with data length opcode, src, dst Constants preceded by $ Registers preceded by % IndirecUon uses ( )

11 Register InstrucUons: sub registers memory %eax 7 subl %eax, %ebx %ebx 9 7 Subtract from a register value

12 The Stack Local storage Good place to keep data that doesn t fit into registers Grows from high addresses towards low addreses

13 Frame InstrucUons: push registers %eax 7 %ebp M %esp N Put a value on the stack memory pushl %eax Frame Pull from register Value goes to %esp Subtract from %esp registers %eax 7 %ebp M %esp N- 4 Example: pushl %eax memory 7 Frame

14 Frame InstrucUons: pop registers %eax 9 %ebp M %esp N Take a value from the stack memory popl %eax 7 Frame Pull from stack pointer Value goes from %esp Add to %esp registers %eax 7 %ebp M %esp N+4 memory Frame

15 Control flow instrucuons: jmp registers memory %eip jmp - 20 K %ebp M %esp Frame N %eip points to the currently execuung instrucuon (in the text secuon) Has uncondiuonal and condiuonal forms registers %eip K- 20 %ebp M %esp N Uses relauve addressing memory Frame

16 Control flow instrucuons: call registers memory %eip K A: call FOO %ebp M %esp Frame N Saves the current instrucuon pointer to the stack Jumps to the argument value registers %eip FOO %ebp M %esp N- 4 memory FOO: (1 st of foo) A Frame

17 Control flow instrucuons: ret registers memory %eip K: ret K %ebp M %esp N A Frame Pops the stack into the instrucuon pointer registers %eip A %ebp M %esp N+4 memory A: (caller instr) Frame

18 Stack instrucuons: leave registers memory %ebp M %esp N leave A Stack Equivalent to movl %ebp, %esp popl %ebp registers %ebp A %esp M memory Stack

19 ImplemenUng a funcuon call %eax 10 1 esp esp esp esp esp (main) (foo) 3 main ebp main eip Stack data ebp ebp main: eip subl eip movl eip movl eip call eip addl $8, %esp $2, 4(%esp) $l, (%esp) foo $8, %esp foo: eip pushl eip movl eip subl eip movl eip movl eip addl eip leave eip ret %ebp %esp, %ebp $16, %esp $3, - 4(%ebp) 8(%ebp), %eax $9, %eax

20 FuncUon Calls: High level points Locals are organized into stack frames Callees exist at lower address than the caller On call: Save %eip so you can restore control Save %ebp so you can restore data ImplementaUon details are largely by convenuon Somewhat codified by hardware

21 Data types / Endianness x86 is a livle- endian architecture pushl %eax esp esp %eax 0xdeadbeef 0xef 0xbe 0xad 0xde 4 bytes

22 esp Arrays (bar).text HEAP.data D 0x44 r 0x72 e 0x65 w 0x77 \0 0x00 caller ebp caller eip+2 &in ebp void bar(char * in){ char name[5]; strcpy(name, in); } bar: pushl %ebp movl %esp, %ebp subl $5, %esp movl 8(%ebp), %eax movl %eax, 4(%esp) leal - 5(%ebp), %eax movl %eax, (%esp) call strcpy leave ret

23 Next Time ExploiUng buffer overflows

24 Tools: GCC gcc O0 S program.c o program.s m32 gcc O0 g program.c o program m32

25 Tools: GDB gdb program (gdb) run (gdb) decompile foo (gdb) quit

26 Tools: objdump objdump Dwrt program

27 od x program Tools: od

28 Summary Basics of x86 Process layout ISA details Most of the instrucuons that you ll need Introduced the concept of a buffer overflow Some tools to play around with x86 assembly