Carnegie Mellon Introduction to Computer Systems 15 213 18 243 spring 2009 10th Lecture Feb 12th Instructors Gregory Kesden and Markus P schel Carnegie Mellon Last Time Structures Alignment c Memory Layout i a p 0 4 16 20 struct S1 char c int i 2 double v p i 0 3 bits p 0 struct rec int i int a 3 int p p 4 i 1 v 4 bits p 8 p 16 p 24 Unions union U1 char c int i 2 double v up c i 0 i 1 v up 0 up 4 up 8 Carnegie Mellon Last Time st 3 st 2 Floating point x87 getting obsolete st 1 st 0 128 bit 2 doubles 4 singles x86 64 SSE3 and later xmm0 xmm15 Vector mode and scalar mode addps addss Carnegie Mellon Today Memory layout Buffer overflow worms and viruses Program optimization Overview Removing unnecessary procedure calls Code motion precomputation Strength reduction Sharing of common subexpressions Optimization blocker Procedure calls Carnegie Mellon IA32 Linux Memory Layout not drawn to scale FF Stack Stack 8MB Runtime stack 8MB limit Heap Dynamically allocated storage When call malloc calloc new Data Statically allocated data E g arrays strings declared in code Text Executable machine instructions Read only Upper 2 hex digits 8 bits of address 08 00 Heap Data Text Carnegie Mellon Memory Allocation Example not drawn to scale FF Stack char big array 1 24 16 MB char huge array 1 28 256 MB int beyond char p1 p2 p3 p4 int useless int p1 p2 p3 p4 return 0 main malloc 1 malloc 1 malloc 1 malloc 1 Some print 28 8 28 8 statements Where does everything go 256 256 256 256 MB B MB B 08 00 Heap Data Text Carnegie Mellon IA32 Example Addresses not drawn to scale FF Stack address range 232 esp p3 p1 p4 p2 p2 beyond big array huge array main useless final malloc 0xffffbcd0 0x65586008 0x55585008 0x1904a110 0x1904a008 0x18049760 0x08049744 0x18049780 0x08049760 0x080483c6 0x08049744 0x006be166 malloc is dynamically linked address determined at runtime 80 Heap 08 00 Data Text Carnegie Mellon not drawn to scale x86 64 Example Addresses 00007F Stack address range 247 rsp p3 p1 p4 p2 p2 beyond big array huge array main useless final malloc 0x7ffffff8d1f8 0x2aaabaadd010 0x2aaaaaadc010 0x000011501120 0x000011501010 0x000010500a60 0x000000500a44 0x000010500a80 0x000000500a50 0x000000400510 0x000000400500 0x00386ae6a170 malloc is dynamically linked address determined at runtime 000030 Heap Data Text 000000 Carnegie Mellon C operators Operators type sizeof has very high precedence has very high precedence monadic just below Associativity left to right right to left left to right left to right left to right left to right left to right left to right left to right left to right left to right left to right right to left right to left left to right Carnegie Mellon C Pointer Declarations Test Yourself int p p is a pointer to int int p 13 p is an array 13 of pointer to int int p 13 p is an array 13 of pointer to int int p p is a pointer to a pointer to an int int p 13 p is a pointer to an array 13 of int int f f is a function returning a pointer to int int f f is a pointer to a function returning int int f 13 f is a function returning ptr to an array 13 of pointers to functions returning int int x 3 5 x is an array 3 of pointers to functions returning pointers to array 5 of ints Carnegie Mellon C Pointer Declarations Check out guide int p p is a pointer to int int p 13 p is an array 13 of pointer to int int p 13 p is an array 13 of pointer to int int p p is a pointer to a pointer to an int int p 13 p is a pointer to an array 13 of int int f f is a function returning a pointer to int int f f is a pointer to a function returning int int f 13 f is a function returning ptr to an array 13 of pointers to functions returning int int x 3 5 x is an array 3 of pointers to functions returning pointers to array 5 of ints Carnegie Mellon Avoiding Complex Declarations Use typedef to build up the declaration Instead of int x 3 5 typedef int fiveints 5 typedef fiveints p5i typedef p5i f of p5is f of p5is x 3 x is an array of 3 elements each of which is a pointer to a function returning an array of 5 ints Carnegie Mellon Today Memory layout Buffer overflow worms and viruses Program optimization Overview Removing unnecessary procedure calls Code motion precomputation Strength reduction Sharing of common subexpressions Optimization blocker Procedure calls Carnegie Mellon Internet Worm and IM War November 1988 Internet Worm attacks thousands of Internet hosts How did it happen Carnegie Mellon String Library Code Implementation of Unix function gets Get string from stdin char gets char dest int c getchar char p dest while c EOF c n p c c getchar p 0 return dest No way to specify limit on number of characters to read Similar problems with other Unix functions strcpy Copies string of arbitrary length scanf fscanf sscanf when given s conversion specification Carnegie Mellon Vulnerable Buffer Code Echo Line void echo char buf 4 gets buf puts buf Way too small int main printf Type a string echo return 0 unix bufdemo Type a string 1234567 1234567 unix bufdemo Type a string 12345678 Segmentation Fault unix bufdemo Type a string 123456789ABC Segmentation Fault Carnegie Mellon Buffer Overflow Disassembly 080484f0 echo 80484f0 55 80484f1 89 e5 80484f3 53 80484f4 8d 5d 80484f7 83 ec 80484fa 89 1c 80484fd e8 ae 8048502 89 1c 8048505 e8 8a 804850a 83 c4 804850d 5b 804850e c9 804850f c3 80485f2 80485f7 80485fa 80485fb 80485fd f8 14 24 ff ff ff 24 fe ff ff 14 e8 f9 fe ff ff 8b 5d fc c9 31 c0 c3 push mov push lea sub mov call mov call add pop leave ret ebp esp ebp ebx 0xfffffff8 ebp ebx 0x14 esp ebx esp 80484b0 gets ebx esp 8048394 puts plt 0x14 esp ebx call 80484f0 echo mov 0xfffffffc ebp ebx leave xor eax eax ret Carnegie Mellon Buffer Overflow Stack Before call to gets Stack Frame for main Return Address Saved ebp ebp 3 2 1 0 buf Stack Frame for echo echo pushl movl pushl leal subl movl call Echo Line void echo char buf 4 gets buf puts buf ebp esp ebp ebx 8 ebp ebx 20 esp ebx esp gets Way too small Save ebp on stack Save ebx Compute buf as ebp 8 Allocate stack space Push buf on stack Call gets Carnegie Mellon unix gdb bufdemo gdb break echo Breakpoint 1 at 0x8048583 gdb run Breakpoint 1 0x8048583 in echo gdb print x ebp 1 0xffffc638 gdb print x unsigned ebp 2 0xffffc658 gdb print x unsigned ebp 1 3 0x80485f7 Buffer Overflow Stack Example Before call to gets Before call to gets 0xffffc658 Stack Frame …
View Full Document
Unlocking...