Function Call Convention

Size: px

Start display at page:

Download "Function Call Convention"

Darlene Watkins
5 years ago
Views:

1 Function Call Convention Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel Fax

2 Content Intel Architecture Memory Layout C Arrays Buffer Overflow BoF Exploit Assembler Shellcode Function Calls Debugging Remote Exploit Exploit Mitigations Defeat Exploit Mitigations Slide 2

3 Function Call Convention Function call convention: How functions work Program-metadata on the stack Stack based buffer overflow: Overwrite program-metadata on the stack Slide 3

4 x32 Memory Layout 0xc xbfffffff Stack Heap 0x Code 0x Slide 4

5 Stacks How do they work? Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel Fax

6 Stack push pop Slide 6

7 Stack 0x x00010 push pop Slide 7

8 Stack Push 0x1 Push 0x2 Push 0x3 0x01 0x02 0x03 0x04 Pop Push 0x4 Slide 8

9 x32 Call Convention Functions and the Stack Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel Fax

10 x32 Call Convention What is a function? Self contained subroutine Re-usable Can be called from anywhere After function is finished: Jump to the calling function (calee) Slide 10

11 x32 Call Convention void main(void) { int blubb = 0; foobar(blubb); return; } void foobar (int arg1) { char compass1[]; char compass2[]; } Slide 11

12 x32 Call Convention What does the function foobar() need? Function Argument: blubb Local variables Compass1 Compass2 And: Address of next instruction in main() &return Slide 12

13 x32 Call Convention Saved IP (& libc_start) Saved Frame Pointer Local Variables <main> SFP blubb Stack Frame <main> Argument for <foobar> Saved IP (&return) Saved Frame Pointer Local Variables <foobar> &blubb SFP compass1 compass2 Stack Frame <foobar> push pop Slide 13

14 x32 Call Convention void main(void) { int blubb = 0; foobar(blubb); return; } pointer Save ptr &blubb SFP void foobar (int arg1) { char compass1[]; char compass2[]; } allocate compass1 compass2 push pop Slide 14

15 x32 Call Convention Saved IP (& libc_start) Saved Frame Pointer Local Variables <main> SFP blubb Stack Frame <main> Argument for <foobar> Saved IP (&return) Saved Frame Pointer Local Variables <foobar> &blubb (&return) SFP compass1 compass2 Stack Frame <foobar> push pop Slide 15

16 x32 Call Convention : Stored Instruction Pointer Copy of EIP Points to the address where control flow continues after end of function (return, ret) Usually points into the code section Slide 16

17 x32 Call Convention Attention! Assembler ahead! AT&T vs Intel syntax Intel syntax: mov mov int eax,1 ebx,0ffh 80h AT&T syntax: movl movl $1,%eax $0xff,%ebx int $0x80 Slide 17

18 x32 Call Convention In ASM: call 0x <&foobar> push EIP jmp 0x <function code> (0x ) ret pop eip Slide 18

19 x32 Call Convention In ASM: call 0x <&foobar> push EIP jmp 0x mov ebp, esp <function code> mov esp, ebp ret pop eip Slide 19

20 x32 Call Convention In ASM: call 0x <&foobar> push EIP jmp 0x mov ebp, esp <function code> mov esp, ebp ret pop eip Prolog Function Epilog Slide 20

21 x32 Call Convention Writes go up 0xFFFF 0x0100 arg1 SFP compass1 compass2 Stack grows down push pop Slide 21

22 x32 Call Convention Recap: User data is on the stack Also: important stuff is on the stack (Instruction Pointer, ) Stack grows down Writes go up Slide 22

23 x32 Call Convention Details Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel Fax

24 x32 Call Convention Details int add(int x, int y) { int sum; sum = x + y; return sum; } Slide 24

25 x32 Call Convention Details c = add(3, 4) push 4 push 3 call add push 4 push 3 push EIP jmp add C ASM ASM, detailed Slide 25

26 x32 Call Convention Details add(): push 4 push ebp push 3 mov ebp, esp, push EIP sub esp, 0x10 jmp add mov eax, DWORD PTR [ebp + 0xc] mov edx, DWORD PTR [ebp + 0x8] add eax, edx mov DWORD PTR [ebp 0x04], eax mov eax, DWORD PTR [ebp 0x04] leave ret Slide 26

27 x32 Call Convention Details add(): push 4 push ebp push 3 mov ebp, esp, push EIP sub esp, 0x10 jmp add mov eax, DWORD PTR [ebp + 0xc] mov edx, DWORD PTR [ebp + 0x8] add eax, edx mov DWORD PTR [ebp 0x04], eax mov eax, DWORD PTR [ebp 0x04] mov esp, ebp pop ebp ret ; leave ; leave Slide 27

28 x32 Call Convention Details add(): push 4 push ebp push 3 mov ebp, esp, push EIP sub esp, 0x10 jmp add mov eax, DWORD PTR [ebp + 0xc] mov edx, DWORD PTR [ebp + 0x8] add eax, edx mov DWORD PTR [ebp 0x04], eax mov eax, DWORD PTR [ebp 0x04] mov esp, ebp pop ebp pop eip ; leave ; leave ; ret Slide 28

29 x32 Call Convention Details add(): push 4 push ebp push 3 mov ebp, esp, push EIP sub esp, 0x10 jmp add mov esp, ebp pop ebp pop eip ; leave ; leave ; ret Slide 29

30 Function Prolog Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel Fax

31 x32 Call Convention - Function Prolog push 4 push 3 call add EBP ESP SFP c From: <main> Slide 31

32 x32 Call Convention - Function Prolog push 4 push 3 call add EBP ESP SFP c 4 From: <main> Slide 32

33 x32 Call Convention - Function Prolog push 4 push 3 call add EBP ESP EIP SFP c 4 3 From: <main> Slide 33

34 x32 Call Convention - Function Prolog push 4 push 3 call add EBP ESP EIP SFP c 4 3 From: <main> = EIP push ebp mov ebp, esp, sub esp, 0x10 mov esp, ebp pop ebp pop eip Slide 34

35 x32 Call Convention - Function Prolog push 4 push 3 call add EBP ESP EIP SFP c 4 3 From: <main> = EIP push ebp mov ebp, esp, sub esp, 0x10 mov esp, ebp pop ebp pop eip Slide 35

36 x32 Call Convention - Function Prolog push ebp mov ebp, esp, sub esp, 0x10 mov esp, ebp pop ebp pop eip EBP ESP SFP c 4 3 From: <main> From: <add> Slide 36

37 x32 Call Convention - Function Prolog push ebp mov ebp, esp, sub esp, 0x10 mov esp, ebp pop ebp pop eip EBP ESP SFP c 4 3 From: <main> SBP From: <add> Slide 37

38 x32 Call Convention - Function Prolog push ebp mov ebp, esp, sub esp, 0x10 mov esp, ebp pop ebp pop eip EBP ESP SFP c 4 3 From: <main> SBP From: <add> Slide 38

39 x32 Call Convention - Function Prolog push ebp mov ebp, esp, sub esp, 0x10 mov esp, ebp pop ebp pop eip EBP ESP SFP c 4 3 From: <main> SBP From: <add> Slide 39

40 Execute Function Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel Fax

41 x32 Call Convention - Execute Function EBP mov eax, DWORD PTR [ebp + 0xc] mov edx, DWORD PTR [ebp + 0x8] add eax, edx mov DWORD PTR [ebp 0x04], eax mov eax, DWORD PTR [ebp 0x04] SFP c 4 EBP+0xc 3 EBP+0x8 SBP sum EBP-0x04 From: <main> From: <add> Slide 41

42 Function Epilog Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel Fax

43 x32 Call Convention - Function Epilog push ebp mov ebp, esp, sub esp, 0x10 mov esp, ebp pop ebp pop eip EBP ESP SFP c 4 3 From: <main> SBP From: <add> Slide 43

44 x32 Call Convention - Function Epilog push ebp mov ebp, esp, sub esp, 0x10 mov esp, ebp pop ebp pop eip EBP ESP SFP c 4 3 From: <main> SBP From: <add> Slide 44

45 x32 Call Convention - Function Epilog push ebp mov ebp, esp, sub esp, 0x10 mov esp, ebp pop ebp pop eip EBP ESP EIP SFP c 4 3 From: <main> SBP Slide 45

46 x32 Call Convention - Function Epilog push ebp mov ebp, esp, sub esp, 0x10 mov esp, ebp pop ebp pop eip EBP ESP EIP SFP c 4 3 From: <main> push 4 SBP push 3 push EIP jmp add Slide 46

47 x32 Call Convention - Function Epilog push ebp mov ebp, esp, sub esp, 0x10 mov esp, ebp pop ebp pop eip EBP ESP EIP SFP c 4 3 From: <main> push 4 push 3 push EIP jmp add Slide 47

48 x32 Call Convention - Function Calling call <addr> = push EIP jmp <addr> leave = mov esp, ebp pop ebp ret = pop eip Slide 48

49 x32 Call Convention - Function Calling push ebp mov ebp, esp sub esp, imm enter: 8 cycle latency micro ops call <addr>; mov ebp, esp; sub esp, imm: 3 cycles latency 4-6 micro ops Slide 49

50 Function Call in x64 Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel Fax

51 x32 Call Convention - Function Call in x64 Differences between x32 and x64 function calls: Arguments are in registers (not on stack) RDI, RSI, RDX, R8, R9 Slide 51

52 x32 Call Convention - Function Call in x64 Differences between x32 and x64 function calls Different ASM commands doing the same thing callq (call) leaveq (leave) retq (ret) Slide 52

53 x32 Call Convention - Function Calling Recap: When a function is called: EIP is pushed on the stack (=) At the end of the function: is recovered into EIP Slide 53

54 Function Call Convention Cheat Sheet x32 Parameter Syscall nr in x32 userspace stack x32 syscalls ebx, ecx, edx, esi, edi, ebp eax x64 Parameter Syscall nr in x64 userspace rdi, rsi, rdx, rcx, r8, r9 x64 syscall rdi, rsi, rdx, r10, r8, r9 rax Slide 54

Intel Architecture. Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona

Intel Architecture. Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Intel Architecture Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch www.csnc.ch Content Intel Architecture Memory Layout C Arrays