UT CS 429H - Machine-Level Programming IV - x86-64 Procedures, Data

Unformatted text preview:

Slide 1Todayx86-64 Integer Registers: Usage Conventionsx86-64 Registersx86-64 Locals in the Red ZoneInteresting Features of Stack FrameTodayStructure AllocationStructure AccessGenerating Pointer to Structure MemberFollowing Linked ListTodayBasic Data TypesArray AllocationArray AccessArray ExampleArray Accessing ExampleArray Loop Example (IA32)Pointer Loop Example (IA32)Nested Array ExampleMultidimensional (Nested) ArraysNested Array Row AccessNested Array Row Access CodeNested Array Row AccessNested Array Element Access CodeMulti-Level Array ExampleElement Access in Multi-Level ArrayArray Element AccessesN X N Matrix Code16 X 16 Matrix Accessn X n Matrix AccessOptimizing Fixed Array AccessOptimizing Fixed Array AccessOptimizing Variable Array AccessSummaryMalicious Use of Buffer OverflowVulnerable Buffer CodeAvoiding Overflow VulnerabilitySystem-Level ProtectionsStack CanariesProtected Buffer DisassemblySetting Up CanaryChecking CanaryCanary Example11Machine-Level Programming IV:x86-64 Procedures, Data2TodayProcedures (x86-64)ArraysOne-dimensionalMulti-dimensional (nested)Multi-levelStructuresAllocationAccess4%rax%rbx%rcx%rdx%rsi%rdi%rsp%rbpx86-64 Integer Registers: Usage Conventions%r8%r9%r10%r11%r12%r13%r14%r15Callee savedCallee savedCallee savedCallee savedCallee savedCaller savedCallee savedStack pointerCaller SavedReturn valueArgument #4Argument #1Argument #3Argument #2Argument #6Argument #55x86-64 RegistersArguments passed to functions via registersIf more than 6 integral parameters, then pass rest on stackThese registers can be used as caller-saved as wellAll references to stack frame via stack pointerEliminates need to update %ebp/%rbpOther Registers6 callee saved2 caller saved1 return value (also usable as caller saved)1 special (stack pointer)7x86-64 Locals in the Red ZoneAvoiding Stack Pointer ChangeCan hold all information within small window beyond stack pointer/* Swap, using local array */void swap_a(long *xp, long *yp) { volatile long loc[2]; loc[0] = *xp; loc[1] = *yp; *xp = loc[1]; *yp = loc[0];}swap_a: movq (%rdi), %rax movq %rax, -24(%rsp) movq (%rsi), %rax movq %rax, -16(%rsp) movq -16(%rsp), %rax movq %rax, (%rdi) movq -24(%rsp), %rax movq %rax, (%rsi) retrtn Ptrunused%rsp−8loc[1]loc[0]−16−2412Interesting Features of Stack FrameAllocate entire frame at onceAll stack accesses can be relative to %rspDo by decrementing stack pointerCan delay allocation, since safe to temporarily use red zoneSimple deallocationIncrement stack pointerNo base/frame pointer needed14TodayProcedures (x86-64)ArraysOne-dimensionalMulti-dimensional (nested)Multi-levelStructuresAllocationAccess15struct rec { int a[3]; int i; struct rec *n;};Structure AllocationConceptContiguously-allocated region of memoryRefer to members within structure by namesMembers may be of different typesMemory Layoutia n012162016struct rec { int a[3]; int i; struct rec *n;};IA32 Assembly# %edx = val# %eax = rmovl %edx, 12(%eax) # Mem[r+12] = valvoid set_i(struct rec *r, int val){ r->i = val;}Structure AccessAccessing Structure MemberPointer indicates first byte of structureAccess elements with offsetsia n0121620r+12r17movl 12(%ebp), %eax # Get idxsall $2, %eax # idx*4addl 8(%ebp), %eax # r+idx*4int *get_ap (struct rec *r, int idx){ return &r->a[idx];}Generating Pointer to Structure MemberGenerating Pointer to Array ElementOffset of each structure member determined at compile timeArgumentsMem[%ebp+8]: rMem[%ebp+12]: idxr+idx*4ria n0121620struct rec { int a[3]; int i; struct rec *n;};18 .L17: # loop: movl 12(%edx), %eax # r->i movl %ecx, (%edx,%eax,4) # r->a[i] = val movl 16(%edx), %edx # r = r->n testl %edx, %edx # Test r jne .L17 # If != 0 goto loopvoid set_val (struct rec *r, int val){ while (r) { int i = r->i; r->a[i] = val; r = r->n; }}Following Linked ListC Codestruct rec { int a[3]; int i; struct rec *n;};ia n0121620Element iRegister Value%edx r%ecx val19TodayProcedures (x86-64)ArraysOne-dimensionalMulti-dimensional (nested)Multi-levelStructures20Basic Data TypesIntegralStored & operated on in general (integer) registersSigned vs. unsigned depends on instructions usedIntel ASMBytes Cbyte b 1 [unsigned] charword w 2 [unsigned] shortdouble word l 4 [unsigned] intquad word q 8 [unsigned] long int (x86-64)Floating PointStored & operated on in floating point registersIntel ASMBytes CSingle s 4 floatDouble l 8 doubleExtended t 10/12/16 long double21Array AllocationBasic PrincipleT A[L];Array of data type T and length LContiguously allocated region of L * sizeof(T) byteschar string[12];x x + 12int val[5];xx + 4 x + 8 x + 12 x + 16 x + 20double a[3];x + 24xx + 8 x + 16char *p[3];xx + 8 x + 16x + 24xx + 4 x + 8 x + 12IA32x86-6422Array AccessBasic PrincipleT A[L];Array of data type T and length LIdentifier A can be used as a pointer to array element 0: Type T*Reference Type Valueval[4] int 3val int * xval+1 int * x + 4&val[2] int * x + 8val[5] int ??*(val+1) int 5val + i int * x + 4 iint val[5];1 5 2 1 3xx + 4 x + 8 x + 12 x + 16 x + 2023Array ExampleDeclaration “zip_dig ut” equivalent to “int ut[5]”Example arrays were allocated in successive 20 byte blocksNot guaranteed to happen in general#define ZLEN 5typedef int zip_dig[ZLEN];zip_dig ut = { 7, 8, 7, 1, 2 };zip_dig mit = { 0, 2, 1, 3, 9 };zip_dig ucb = { 9, 4, 7, 2, 0 };zip_dig ut;7 8 7 1 21620 24 28 32 36zip_dig mit;0 2 1 3 93640 44 48 52 56zip_dig ucb;9 4 7 2 05660 64 68 72 7624Array Accessing ExampleRegister %edx contains starting address of arrayRegister %eax contains array indexDesired digit at 4*%eax + %edxUse memory reference (%edx,%eax,4)int get_digit (zip_dig z, int dig){ return z[dig];} # %edx = z # %eax = digmovl (%edx,%eax,4),%eax # z[dig]IA32zip_dig ut;7 8 7 1 21620 24 28 32 3625 # edx = zmovl $0, %eax # %eax = i.L4: # loop:addl $1, (%edx,%eax,4) # z[i]++addl $1, %eax # i++cmpl $5, %eax # i:5jne .L4 # if !=, goto loopArray Loop Example (IA32)void zincr(zip_dig z) { int i; for (i = 0; i < ZLEN; i++) z[i]++;}26Pointer Loop Example (IA32)void zincr_p(zip_dig z) { int *zend = z+ZLEN; do { (*z)++; z++; } while (z != zend); }void zincr_v(zip_dig z) { void *vz = z; int i = 0; do { (*((int *) (vz+i)))++; i += ISIZE; }


View Full Document

UT CS 429H - Machine-Level Programming IV - x86-64 Procedures, Data

Download Machine-Level Programming IV - x86-64 Procedures, Data
Our administrator received your request to download this document. We will send you the file to your email shortly.
Loading Unlocking...
Login

Join to view Machine-Level Programming IV - x86-64 Procedures, Data and access 3M+ class-specific study document.

or
We will never post anything without your permission.
Don't have an account?
Sign Up

Join to view Machine-Level Programming IV - x86-64 Procedures, Data 2 2 and access 3M+ class-specific study document.

or

By creating an account you agree to our Privacy Policy and Terms Of Use

Already a member?