Andrew login ID:Full Name:CS 15-213, Fall 2005Exam 1Tuesday October 11, 2005Instructions:• Make sure that your exam is not missing any sheets, then write your full name and Andrew login IDon the front.• Write your answers in the space provided below the problem. If you make a mess, clearly indicateyour final answer.• The exam has a maximum score of 58 points.• The problems are of varying difficulty. The point value of each problem is indicated. Pile up the easypoints quickly and then come back to the harder problems.• This exam is OPEN BOOK. You may use any books or notes you like. No electronic devices areallowed. Good luck!1 (10):2 (12):3 (04):4 (05):5 (06):6 (05):7 (08):8 (08):TOTAL (58):Page 1 of 11Problem 1. (10 points):Assume we are running code on a 7-bit machine using two’s complement arithmetic for signed integers. Fillin the empty boxes in the table below. The following definitions are used in the table:int x = -16;unsigned uy = x;• You need not fill in entries marked with “–”.• TMax denotes the largest positive two’s complement number and TMin denotes the smallest negativetwo’s complement number.• Hint: Be careful with the promotion rules that C uses for signed and unsigned ints.Expression Decimal Representation Binary Representation– −2– 001 0011xuyx − uyTMax + 1TMin - 1-TMinTMin + TMinTMax + TMinPage 2 of 11Problem 2. (12 points):Consider the following two 7-bit floating point representations based on the IEEE floating point format.Neither of them have sign bits—they can only represent nonnegative numbers.1. Format A• There are k = 3 exponent bits. The exponent bias is 3.• There are n = 4 fraction bits.2. Format B• There are k = 4 exponent bits. The exponent bias is 7.• There are n = 3 fraction bits.Numeric values are encoded in both of these formats as a value of the form V = M × 2E, where E isexponent after biasing, and M is the significand value. The fraction bits encode the significand value Musing either a denormalized (exponent field 0) or a normalized representation (exponent field nonzero).Below, you are given some bit patterns in Format A, and your task is to convert them to the closest value inFormat B. If rounding is necessary you should round upward. In addition, give the values of numbers givenby the Format A and Format B bit patterns. Give these as whole numbers (e.g., 17) or as fractions (e.g.,17/64).Format A Format BBits Value Bits Value011 0000 1 0111 000 1101 1110010 1001110 1111000 0001Page 3 of 11Problem 3. (4 points):This problem will test your knowledge of buffer overflows. In Lab 3, you performed an overflow attackagainst a program that read user input. The input was read by getbuf() and your goal was to create anexploit string that called smoke().int getbuf(){char buf[32];Gets(buf);return 1;}void smoke(){printf(‘‘Smoke!: You called smoke()\n’’);validate(0);exit(0);}Creating a workable exploit string against a program like the bufbomb usually requires converting theexecutable file into human readable assembly (using objdump) and generating a sequence of raw, oftenunprintable, bytes (using a program like hex2raw).However, with the bufbomb, you may have noticed that any 40 character string will result in smoke()being called.unix> ./bufbomb -t ngmType string:It is easy to love 213 when you’re a TA.Smoke!: You called smoke()VALIDNICE JOB!Page 4 of 11A. Why will any 40-character string result in smoke() being called?The following information may help you in answering this question. Hints:• Recall that getbuf() is called from test().• Also recall that C strings are always terminated by the NULL character.0000000000400f66 <test>:...400f72: b8 00 00 00 00 mov $0x0,%eax400f77: e8 54 00 00 00 callq 400fd0 <getbuf>400f7c: 89 c2 mov %eax,%edx...0000000000400f00 <smoke>:400f00: 48 83 ec 08 sub $0x8,%rsp400f04: bf 1c 25 40 00 mov $0x40251c,%edi400f09: e8 fa fe ff ff callq 400e08 <puts@plt>400f0e: bf 00 00 00 00 mov $0x0,%edi400f13: e8 0c 07 00 00 callq 401624 <validate>400f18: bf 00 00 00 00 mov $0x0,%edi400f1d: e8 76 fe ff ff callq 400d98 <exit@plt>0000000000400fd0 <getbuf>:400fd0: 48 83 ec 28 sub $0x28,%rsp400fd4: 48 89 e7 mov %rsp,%rdi400fd7: e8 ff 00 00 00 callq 4010db <Gets>400fdc: b8 01 00 00 00 mov $0x1,%eax400fe1: 48 83 c4 28 add $0x28,%rsp400fe5: c3 retqPage 5 of 11Problem 4. (5 points):Consider the code below, where L, M, and N are constants declared with #define.int array1[L][M][N];int array2[M][N][L];int copy(int i, int j, int k){array1[i][j][k] = array2[j][k][i];}Suppose the above code generates the following assembly code:copy:movslq %edi,%rdimovslq %esi,%rsimovslq %edx,%rdxmovq %rdi, %raxsalq $5, %raxaddq %rdi, %raxaddq %rsi, %raxleaq (%rsi,%rsi,8), %rsileaq (%rdx,%rax,2), %raxleaq (%rdx,%rdx,8), %rdxleaq (%rdx,%rsi,2), %rsiaddq %rdi, %rsimovl array2(,%rsi,4), %edxmovl %edx, array1(,%rax,4)retWhat are the values of L, M, and N?L =M =N =Page 6 of 11Problem 5. (6 points):Consider the following C function and its corresponding x86-64 assembly code:int foo(int x, int i){switch(i){case 1:x -= 10;case 2:x *= 8;break;case 3:x += 5;case 5:x /= 2;break;case 0:x &= 1;default:x += i;}return x;}00000000004004a8 <foo>:4004a8: mov %edi,%edx4004aa: cmp $0x5,%esi4004ad: ja 4004d4 <foo+0x2c>4004af: mov %esi,%eax4004b1: jmpq *0x400690(,%rax,8)4004b8: sub $0xa,%edx4004bb: shl $0x3,%edx4004be: jmp 4004d6 <foo+0x2e>4004c0: add $0x5,%edx4004c3: mov %edx,%eax4004c5: shr $0x1f,%eax4004c8: lea (%rdx,%rax,1),%eax4004cb: mov %eax,%edx4004cd: sar %edx4004cf: jmp 4004d6 <foo+0x2e>4004d1: and $0x1,%edx4004d4: add %esi,%edx4004d6: mov %edx,%eax4004d8: retqRecall that the gdb command x/g $rsp will examine an 8-byte word starting at address in $rsp. Pleasefill in the switch jump table as printed out via the following gdb command:>(gdb) x/6g 0x4006900x400690: 0x__________________ 0x__________________0x4006a0: 0x__________________ 0x__________________0x4006b0: 0x__________________ 0x__________________Page 7 of 11Problem 6. (5 points):Consider the following function’s assembly code:0040050a <bar>:40050d: b9 00 00 00 00 mov $0x0,%ecx400512: 8d 47 03 lea 0x3(%rdi),%eax400515: 83 ff ff cmp $0xffffffffffffffff,%edi400518: 0f 4e f8 cmovle %eax,%edi40051b: 89 fa mov %edi,%edx40051d: c1 fa 02 sar $0x2,%edx400520: 85 d2 test %edx,%edx400522: 7e 14 jle 400538 <bar2+0x2b>400524: 8d 42 03 lea 0x3(%rdx),%eax400527: 83 fa ff cmp $0xffffffffffffffff,%edx40052a: 0f 4f c2 cmovg %edx,%eax40052d: 89 c2 mov %eax,%edx40052f: c1 fa 02
View Full Document