Stack Tutorial. Young W. Lim Sat. Young W. Lim Stack Tutorial Sat 1 / 15

Transcription

1 Stack Tutorial Young W. Lim Sat Young W. Lim Stack Tutorial Sat 1 / 15

2 Outline 1 Introduction References Stack Background Transferring Control Young W. Lim Stack Tutorial Sat 2 / 15

3 Based on "Self-service Linux: Mastering the Art of Problem Determination", Mark Wilding "Computer Architecture: A Programmer s Perspective", Bryant & O Hallaron I, the copyright holder of this work, hereby publish it under the following licenses: GNU head Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled GNU Free Documentation License. CC BY SA This file is licensed under the Creative Commons Attribution ShareAlike 3.0 Unported License. In short: you are free to share and make derivative works of the file under the conditions that you appropriately attribute it, and that you distribute it only under a license compatible with this one. Young W. Lim Stack Tutorial Sat 3 / 15

4 Stack Frame procedure calls pass procedure arguments store the return info save registers stack frame: the portion of the stack allocated for single procedure call frame pointer (%ebp) stack pointer (%esp) Young W. Lim Stack Tutorial Sat 4 / 15

5 Stack Frames & Pointers Frame Pointer (%ebp) : High : bottom of a stack frame Stack Pointer (%esp) : Low : top of a stack frame stack grows toward lower addresses pushl decrease %esp (growing stack) popl increase %esp (shrinking stack) data accessed via %ebp Young W. Lim Stack Tutorial Sat 5 / 15

6 Stack Frames & Arguments Caller P Callee Q Caller P s Stack Frame Argument values to Q Return address to P Callee Q Stack Frame P s frame pointer (%ebp) Saved registers (some local vars) Local variables Temporaries Q s arguments to other functions Young W. Lim Stack Tutorial Sat 6 / 15

7 Stack Frames & Heap HIGH ADDRESS - STACK (stack frame grows toward lower addresses) Stack Frame #1 Stack Frame #2... Stack Frame #n Currently Unused Heap (heap grows toward higher addresses) Global Variables (BSS Seg) Static Variables (Data Seg) Machine Code (Text(ELF)) LOW ADDRESS - Young W. Lim Stack Tutorial Sat 7 / 15

8 Procedure Instructions Procedure Call call label (direct call) call *operand (indirect call) Procedure Return leave (stack preparation) ret Young W. Lim Stack Tutorial Sat 8 / 15

9 Call Instructions push a return address jump to the start the called function return address the address of the instruction immediately following the call instruction Direct Call call label Indirect call call *operand offset Imm a base reg Eb an index reg Ei a scale factor s Young W. Lim Stack Tutorial Sat 9 / 15

10 Ret Instructions ret instruction pops the return address from the stack jump to the return address location stack pointer must points to the return address leave instruction prepare the stack for returning equivalent to the following mov %ebp, %esp Set stack ptr to the beginning of the stack) pop %ebp Restore saved %ebp Set the stack ptr to the end of caller s stack Young W. Lim Stack Tutorial Sat 10 / 15

11 /proc/<pid>/maps file stack frame starts from 0xc stack bottom : 0xc stack address range 0xbfffe000 (low address) 0xc (high address) stack grows toward lower address Young W. Lim Stack Tutorial Sat 11 / 15

12 checking /proc/<pid>/maps file (1) local variables (stack variables) : stack_var local variable address : 0xbffff2dc #inclde <stdio.h> int main(void) { int stack_var = 5; char cmd[64]; printf("addr(stack_var) = 0x%x \n\n", &stack_var); sprintf(cmd, "cat /proc/%d/maps", getpid()); system(cmd); } return 0; Young W. Lim Stack Tutorial Sat 12 / 15

13 checking /proc/<pid>/maps file (2) #inclde <stdio.h> int main(void) { int stack_var = 5; char cmd[64]; } printf("&stack_var = 0x%x\n", &stack_var); printf("&argc = 0x%x\n", &argc ); printf(" argv = 0x%x\n", argv ); printf(" environ = 0x%xn", environ ); printf(" argv[0] = 0x%x\n", argv[0] ); printf("*environ = 0x%x\n", *environ ); sprintf(cmd, "cat /proc/%d/maps", getpid()); system(cmd); return 0; Young W. Lim Stack Tutorial Sat 13 / 15

14 checking /proc/<pid>/maps file (3) [from] 0xbfffe000 &stack_var 0xbffff2dc --- stack top &argc 0xbffff2f0 argv 0xbffff334 environ 0xbffff33c argv[0] 0xbffff4d5 *environ 0xbffff4de (low address) [to] 0xc stack bottom (high address) Young W. Lim Stack Tutorial Sat 14 / 15

15 checking /proc/<pid>/maps file (4) [to] 0xc stack bottom (high address) path name specified in exec() process environment variables argv strings argc aux vectors [from] 0xbfffe000 Young W. Lim Stack Tutorial Sat 15 / 15