Slide 1Todayx86-64 Integer Registers: Usage Conventionsx86-64 Registersx86-64 Locals in the Red ZoneInteresting Features of Stack FrameTodayStructure AllocationStructure AccessGenerating Pointer to Structure MemberFollowing Linked ListTodayBasic Data TypesArray AllocationArray AccessArray ExampleArray Accessing ExampleArray Loop Example (IA32)Pointer Loop Example (IA32)Nested Array ExampleMultidimensional (Nested) ArraysNested Array Row AccessNested Array Row Access CodeNested Array Row AccessNested Array Element Access CodeMulti-Level Array ExampleElement Access in Multi-Level ArrayArray Element AccessesN X N Matrix Code16 X 16 Matrix Accessn X n Matrix AccessOptimizing Fixed Array AccessOptimizing Fixed Array AccessOptimizing Variable Array AccessSummaryMalicious Use of Buffer OverflowVulnerable Buffer CodeAvoiding Overflow VulnerabilitySystem-Level ProtectionsStack CanariesProtected Buffer DisassemblySetting Up CanaryChecking CanaryCanary Example11Machine-Level Programming IV:x86-64 Procedures, Data2TodayProcedures (x86-64)ArraysOne-dimensionalMulti-dimensional (nested)Multi-levelStructuresAllocationAccess4%rax%rbx%rcx%rdx%rsi%rdi%rsp%rbpx86-64 Integer Registers: Usage Conventions%r8%r9%r10%r11%r12%r13%r14%r15Callee savedCallee savedCallee savedCallee savedCallee savedCaller savedCallee savedStack pointerCaller SavedReturn valueArgument #4Argument #1Argument #3Argument #2Argument #6Argument #55x86-64 RegistersArguments passed to functions via registersIf more than 6 integral parameters, then pass rest on stackThese registers can be used as caller-saved as wellAll references to stack frame via stack pointerEliminates need to update %ebp/%rbpOther Registers6 callee saved2 caller saved1 return value (also usable as caller saved)1 special (stack pointer)7x86-64 Locals in the Red ZoneAvoiding Stack Pointer ChangeCan hold all information within small window beyond stack pointer/* Swap, using local array */void swap_a(long *xp, long *yp) { volatile long loc[2]; loc[0] = *xp; loc[1] = *yp; *xp = loc[1]; *yp = loc[0];}swap_a: movq (%rdi), %rax movq %rax, -24(%rsp) movq (%rsi), %rax movq %rax, -16(%rsp) movq -16(%rsp), %rax movq %rax, (%rdi) movq -24(%rsp), %rax movq %rax, (%rsi) retrtn Ptrunused%rsp−8loc[1]loc[0]−16−2412Interesting Features of Stack FrameAllocate entire frame at onceAll stack accesses can be relative to %rspDo by decrementing stack pointerCan delay allocation, since safe to temporarily use red zoneSimple deallocationIncrement stack pointerNo base/frame pointer needed14TodayProcedures (x86-64)ArraysOne-dimensionalMulti-dimensional (nested)Multi-levelStructuresAllocationAccess15struct rec { int a[3]; int i; struct rec *n;};Structure AllocationConceptContiguously-allocated region of memoryRefer to members within structure by namesMembers may be of different typesMemory Layoutia n012162016struct rec { int a[3]; int i; struct rec *n;};IA32 Assembly# %edx = val# %eax = rmovl %edx, 12(%eax) # Mem[r+12] = valvoid set_i(struct rec *r, int val){ r->i = val;}Structure AccessAccessing Structure MemberPointer indicates first byte of structureAccess elements with offsetsia n0121620r+12r17movl 12(%ebp), %eax # Get idxsall $2, %eax # idx*4addl 8(%ebp), %eax # r+idx*4int *get_ap (struct rec *r, int idx){ return &r->a[idx];}Generating Pointer to Structure MemberGenerating Pointer to Array ElementOffset of each structure member determined at compile timeArgumentsMem[%ebp+8]: rMem[%ebp+12]: idxr+idx*4ria n0121620struct rec { int a[3]; int i; struct rec *n;};18 .L17: # loop: movl 12(%edx), %eax # r->i movl %ecx, (%edx,%eax,4) # r->a[i] = val movl 16(%edx), %edx # r = r->n testl %edx, %edx # Test r jne .L17 # If != 0 goto loopvoid set_val (struct rec *r, int val){ while (r) { int i = r->i; r->a[i] = val; r = r->n; }}Following Linked ListC Codestruct rec { int a[3]; int i; struct rec *n;};ia n0121620Element iRegister Value%edx r%ecx val19TodayProcedures (x86-64)ArraysOne-dimensionalMulti-dimensional (nested)Multi-levelStructures20Basic Data TypesIntegralStored & operated on in general (integer) registersSigned vs. unsigned depends on instructions usedIntel ASMBytes Cbyte b 1 [unsigned] charword w 2 [unsigned] shortdouble word l 4 [unsigned] intquad word q 8 [unsigned] long int (x86-64)Floating PointStored & operated on in floating point registersIntel ASMBytes CSingle s 4 floatDouble l 8 doubleExtended t 10/12/16 long double21Array AllocationBasic PrincipleT A[L];Array of data type T and length LContiguously allocated region of L * sizeof(T) byteschar string[12];x x + 12int val[5];xx + 4 x + 8 x + 12 x + 16 x + 20double a[3];x + 24xx + 8 x + 16char *p[3];xx + 8 x + 16x + 24xx + 4 x + 8 x + 12IA32x86-6422Array AccessBasic PrincipleT A[L];Array of data type T and length LIdentifier A can be used as a pointer to array element 0: Type T*Reference Type Valueval[4] int 3val int * xval+1 int * x + 4&val[2] int * x + 8val[5] int ??*(val+1) int 5val + i int * x + 4 iint val[5];1 5 2 1 3xx + 4 x + 8 x + 12 x + 16 x + 2023Array ExampleDeclaration “zip_dig ut” equivalent to “int ut[5]”Example arrays were allocated in successive 20 byte blocksNot guaranteed to happen in general#define ZLEN 5typedef int zip_dig[ZLEN];zip_dig ut = { 7, 8, 7, 1, 2 };zip_dig mit = { 0, 2, 1, 3, 9 };zip_dig ucb = { 9, 4, 7, 2, 0 };zip_dig ut;7 8 7 1 21620 24 28 32 36zip_dig mit;0 2 1 3 93640 44 48 52 56zip_dig ucb;9 4 7 2 05660 64 68 72 7624Array Accessing ExampleRegister %edx contains starting address of arrayRegister %eax contains array indexDesired digit at 4*%eax + %edxUse memory reference (%edx,%eax,4)int get_digit (zip_dig z, int dig){ return z[dig];} # %edx = z # %eax = digmovl (%edx,%eax,4),%eax # z[dig]IA32zip_dig ut;7 8 7 1 21620 24 28 32 3625 # edx = zmovl $0, %eax # %eax = i.L4: # loop:addl $1, (%edx,%eax,4) # z[i]++addl $1, %eax # i++cmpl $5, %eax # i:5jne .L4 # if !=, goto loopArray Loop Example (IA32)void zincr(zip_dig z) { int i; for (i = 0; i < ZLEN; i++) z[i]++;}26Pointer Loop Example (IA32)void zincr_p(zip_dig z) { int *zend = z+ZLEN; do { (*z)++; z++; } while (z != zend); }void zincr_v(zip_dig z) { void *vz = z; int i = 0; do { (*((int *) (vz+i)))++; i += ISIZE; }
View Full Document