Andrew login ID Full Name CS 15 213 Fall 2005 Exam 1 Tuesday October 11 2005 Instructions Make sure that your exam is not missing any sheets then write your full name and Andrew login ID on the front Write your answers in the space provided below the problem If you make a mess clearly indicate your final answer The exam has a maximum score of 58 points The problems are of varying difficulty The point value of each problem is indicated Pile up the easy points quickly and then come back to the harder problems This exam is OPEN BOOK You may use any books or notes you like No electronic devices are allowed Good luck 1 10 2 12 3 04 4 05 5 06 6 05 7 08 8 08 TOTAL 58 Page 1 of 11 Problem 1 10 points Assume we are running code on a 7 bit machine using two s complement arithmetic for signed integers Fill in the empty boxes in the table below The following definitions are used in the table int x 16 unsigned uy x You need not fill in entries marked with TMax denotes the largest positive two s complement number and TMin denotes the smallest negative two s complement number Hint Be careful with the promotion rules that C uses for signed and unsigned ints Expression Decimal Representation 2 Binary Representation 001 0011 x uy x uy TMax 1 TMin 1 TMin TMin TMin TMax TMin Page 2 of 11 Problem 2 12 points Consider the following two 7 bit floating point representations based on the IEEE floating point format Neither of them have sign bits they can only represent nonnegative numbers 1 Format A There are k 3 exponent bits The exponent bias is 3 There are n 4 fraction bits 2 Format B There are k 4 exponent bits The exponent bias is 7 There are n 3 fraction bits Numeric values are encoded in both of these formats as a value of the form V M 2E where E is exponent after biasing and M is the significand value The fraction bits encode the significand value M using either a denormalized exponent field 0 or a normalized representation exponent field nonzero Below you are given some bit patterns in Format A and your task is to convert them to the closest value in Format B If rounding is necessary you should round upward In addition give the values of numbers given by the Format A and Format B bit patterns Give these as whole numbers e g 17 or as fractions e g 17 64 Format A Format B Bits Value Bits Value 011 0000 1 0111 000 1 101 1110 010 1001 110 1111 000 0001 Page 3 of 11 Problem 3 4 points This problem will test your knowledge of buffer overflows In Lab 3 you performed an overflow attack against a program that read user input The input was read by getbuf and your goal was to create an exploit string that called smoke int getbuf char buf 32 Gets buf return 1 void smoke printf Smoke You called smoke n validate 0 exit 0 Creating a workable exploit string against a program like the bufbomb usually requires converting the executable file into human readable assembly using objdump and generating a sequence of raw often unprintable bytes using a program like hex2raw However with the bufbomb you may have noticed that any 40 character string will result in smoke being called unix bufbomb t ngm Type string It is easy to love 213 when you re a TA Smoke You called smoke VALID NICE JOB Page 4 of 11 A Why will any 40 character string result in smoke being called The following information may help you in answering this question Hints Recall that getbuf is called from test Also recall that C strings are always terminated by the NULL character 0000000000400f66 test 400f72 b8 00 00 00 00 400f77 e8 54 00 00 00 400f7c 89 c2 mov callq mov 0x0 eax 400fd0 getbuf eax edx 00 ff 00 00 00 ff sub mov callq mov callq mov callq 0x8 rsp 0x40251c edi 400e08 puts plt 0x0 edi 401624 validate 0x0 edi 400d98 exit plt 0000000000400fd0 getbuf 400fd0 48 83 ec 28 400fd4 48 89 e7 400fd7 e8 ff 00 00 00 400fdc b8 01 00 00 00 400fe1 48 83 c4 28 400fe5 c3 sub mov callq mov add retq 0x28 rsp rsp rdi 4010db Gets 0x1 eax 0x28 rsp 0000000000400f00 smoke 400f00 48 83 ec 08 400f04 bf 1c 25 40 400f09 e8 fa fe ff 400f0e bf 00 00 00 400f13 e8 0c 07 00 400f18 bf 00 00 00 400f1d e8 76 fe ff Page 5 of 11 Problem 4 5 points Consider the code below where L M and N are constants declared with define int array1 L M N int array2 M N L int copy int i int j int k array1 i j k array2 j k i Suppose the above code generates the following assembly code copy movslq movslq movslq movq salq addq addq leaq leaq leaq leaq addq movl movl ret edi rdi esi rsi edx rdx rdi rax 5 rax rdi rax rsi rax rsi rsi 8 rsi rdx rax 2 rax rdx rdx 8 rdx rdx rsi 2 rsi rdi rsi array2 rsi 4 edx edx array1 rax 4 What are the values of L M and N L M N Page 6 of 11 Problem 5 6 points Consider the following C function and its corresponding x86 64 assembly code int foo int x int i switch i case 1 x 10 case 2 x 8 break case 3 x 5 case 5 x 2 break case 0 x 1 default x i return x 00000000004004a8 foo 4004a8 mov edi edx 4004aa cmp 0x5 esi 4004ad ja 4004d4 foo 0x2c 4004af mov esi eax 4004b1 jmpq 0x400690 rax 8 4004b8 sub 0xa edx 4004bb shl 0x3 edx 4004be jmp 4004d6 foo 0x2e 4004c0 add 0x5 edx 4004c3 mov edx eax 4004c5 shr 0x1f eax 4004c8 lea rdx rax 1 eax 4004cb mov eax edx 4004cd sar edx 4004cf jmp 4004d6 foo 0x2e 4004d1 and 0x1 edx 4004d4 add esi edx 4004d6 mov edx eax 4004d8 retq Recall that the gdb command x g rsp will examine an 8 byte word starting at address in rsp Please fill in the switch jump table as printed out via the following gdb command gdb x 6g 0x400690 0x400690 0x 0x 0x4006a0 0x 0x 0x4006b0 0x 0x Page 7 of 11 Problem 6 5 points Consider the following function s assembly code 0040050a bar 40050d 400512 400515 400518 40051b 40051d 400520 400522 400524 400527 40052a 40052d 40052f 400532 400534 400536 400538 40053a b9 8d 83 0f 89 c1 85 7e 8d 83 0f 89 c1 ff 85 7f 89 c3 00 47 ff 4e fa fa d2 14 42 fa 4f c2 fa c1 d2 ec c8 00 00 00 03 ff f8 mov lea cmp cmovle mov sar test jle lea cmp cmovg mov sar inc test jg mov retq 02 03 …
View Full Document
Unlocking...