This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Tentative schedule
Weeks 1-5 x86 assembly and reverse engineering. Lab #1: Defusing the Bomb
(10%) Buffer overflows in C. Lab #2: Buflab++ (10%) Shellcodes and stack overflows. Lab #3: Stacklab (9%) Lock picking: Lab #4: Lockpicking (5%)
Weeks 6-11 Ethics: With great power comes great responsibility Web security OWASP 10. Lab #5: Syndis OWASP lab (10%) Heap overflows / Format string attacks. Lab #6: Tauntlab (13%) Mid term exam (15%) Defenses (NX, DEP, ASLR).
Disassemblerobjdump -d p Useful tool for examining object code Analyzes bit pattern of series of instructions Produces approximate rendition of assembly code Can be run on either complete executable or .o file
Dump of assembler code for function sum:0x080483c4 <sum+0>: push %ebp0x080483c5 <sum+1>: mov %esp,%ebp0x080483c7 <sum+3>: mov 0xc(%ebp),%eax0x080483ca <sum+6>: add 0x8(%ebp),%eax0x080483cd <sum+9>: pop %ebp0x080483ce <sum+10>: ret
Alternate Disassembly
Within gdb Debuggergdb pdisassemble sum Disassemble procedurex/11xb sum Examine the 11 bytes starting at sum
Example: $0x400, $-533 Like C constant, but prefixed with ‘$’ Encoded with 1, 2, or 4 bytes
Register: One of 8 integer registers Example: %eax, %edx But %esp and %ebp reserved for special use Others have special uses for particular instructions
Memory: 4 consecutive bytes of memory at address given by register Simplest example: (%eax) Various other “address modes”
%eax
%ecx
%edx
%ebx
%esi
%edi
%esp
%ebp
25
movl Operand Combinations
Cannot do memory-memory transfer with a single instruction
movl
Imm
Reg
Mem
RegMem
RegMem
Reg
Source Dest C Analog
movl $0x4,%eax temp = 0x4;
movl $-147,(%eax) *p = -147;
movl %eax,%edx temp2 = temp1;
movl %eax,(%edx) *p = temp;
movl (%eax),%edx temp = *p;
Src,Dest
26
Simple Memory Addressing Modes Normal (R) Mem[Reg[R]]
Register R specifies memory address
movl (%ecx),%eax
Displacement D(R) Mem[Reg[R]+D] Register R specifies start of memory region Constant displacement D specifies offset
movl 8(%ebp),%edx
27
Using Simple Addressing Modes
void swap(int *xp, int *yp) { int t0 = *xp; int t1 = *yp; *xp = t1; *yp = t0;} Body
Complete Memory Addressing Modes Most General Form
D(Rb,Ri,S) Mem[Reg[Rb]+S*Reg[Ri]+ D] D: Constant “displacement” 1, 2, or 4 bytes Rb: Base register: Any of 8 integer registers Ri: Index register: Any, except for %esp
Unlikely you’d use %ebp, either S: Scale: 1, 2, 4, or 8 (why these numbers?)
Special Cases(Rb,Ri) Mem[Reg[Rb]+Reg[Ri]]D(Rb,Ri) Mem[Reg[Rb]+Reg[Ri]+D](Rb,Ri,S) Mem[Reg[Rb]+S*Reg[Ri]]
38
Data Representations: IA32 + x86-64 Sizes of C Objects (in Bytes) C Data Type Generic 32-bit Intel IA32 x86-64
unsigned 4 44
int 4 44
long int 4 48
char 1 11
short 2 22
float 4 44
double 8 88
long double 8 10/1216
char * 4 48– Or any other pointer
39
CPU
Assembly Programmer’s View
Programmer-Visible State PC: Program counter
Address of next instruction Called “EIP” (IA32) or “RIP” (x86-64)
Register file Heavily used program data
Condition codes Store status information about most
recent arithmetic operation Used for conditional branching
PCRegisters
Memory
CodeDataStack
Addresses
Data
InstructionsConditionCodes
Memory Byte addressable array Code and user data Stack to support procedures
Some Arithmetic Operations Two Operand Instructions:FormatComputationaddl Src,Dest Dest = Dest + Srcsubl Src,Dest Dest = Dest Srcimull Src,Dest Dest = Dest * Srcsall Src,Dest Dest = Dest << Src Also called shllsarl Src,Dest Dest = Dest >> Src Arithmeticshrl Src,Dest Dest = Dest >> Src Logicalxorl Src,Dest Dest = Dest ^ Srcandl Src,Dest Dest = Dest & Srcorl Src,Dest Dest = Dest | Src
Watch out for argument order! No distinction between signed and unsigned int (why?)
46
Some Arithmetic Operations One Operand Instructionsincl Dest Dest = Dest + 1decl Dest Dest = Dest 1negl Dest Dest = Destnotl Dest Dest = ~Dest
See the chapter from CSAPP for more instructions
47
Arithmetic Expression Example
int arith(int x, int y, int z){ int t1 = x+y; int t2 = z+t1; int t3 = x+4; int t4 = y * 48; int t5 = t3 + t4; int rval = t2 * t5; return rval;}
int arith(int x, int y, int z){ int t1 = x+y; int t2 = z+t1; int t3 = x+4; int t4 = y * 48; int t5 = t3 + t4; int rval = t2 * t5; return rval;}
int arith(int x, int y, int z){ int t1 = x+y; int t2 = z+t1; int t3 = x+4; int t4 = y * 48; int t5 = t3 + t4; int rval = t2 * t5; return rval;}
int arith(int x, int y, int z){ int t1 = x+y; int t2 = z+t1; int t3 = x+4; int t4 = y * 48; int t5 = t3 + t4; int rval = t2 * t5; return rval;}
51
CPU
Assembly Programmer’s View
Programmer-Visible State PC: Program counter
Address of next instruction Called “EIP” (IA32) or “RIP” (x86-64)
Register file Heavily used program data
Condition codes Store status information about most
recent arithmetic operation Used for conditional branching
PCRegisters
Memory
CodeDataStack
Addresses
Data
InstructionsConditionCodes
Memory Byte addressable array Code and user data Stack to support procedures
52
Control: Conditon codes
53
Processor State (IA32, Partial) Information
about currently executing program Temporary data
( %eax, … ) Location of runtime stack
( %ebp,%esp ) Location of current code
control point( %eip, … )
Status of recent tests( CF, ZF, SF, OF )
%eip
General purposeregisters
Current stack top
Current stack frame
Instruction pointer
CF ZF SF OF Condition codes
%eax
%ecx
%edx
%ebx
%esi
%edi
%esp
%ebp
54
Condition Codes (Implicit Setting)
Single bit registersCF Carry Flag (for unsigned) SF Sign Flag (for signed)ZF Zero Flag OF Overflow Flag (for signed)
Implicitly set (think of it as side effect) by arithmetic operationsExample: addl/addq Src,Dest ↔ t = a+bCF set if carry out from most significant bit (unsigned overflow)ZF set if t == 0SF set if t < 0 (as signed)OF set if two’s-complement (signed) overflow(a>0 && b>0 && t<0) || (a<0 && b<0 && t>=0)
Not set by lea instruction
55
Condition Codes (Explicit Setting: Compare)
Explicit Setting by Compare Instructioncmpl Src2, Src1cmpl b,a like computing a-b without setting destination
CF set if carry out from most significant bit (used for unsigned comparisons)ZF set if a == bSF set if (a-b) < 0 (as signed)OF set if two’s-complement (signed) overflow(a>0 && b<0 && (a-b)<0) || (a<0 && b>0 && (a-b)>0)
56
Condition Codes (Explicit Setting: Test)
Explicit Setting by Test instructiontestl Src2, Src1testl b,a like computing a&b without setting destination
Sets condition codes based on value of Src1 & Src2Useful to have one of the operands be a mask
ZF set when a&b == 0SF set when a&b < 0
57
Reading Condition Codes SetX Instructions
Set single byte based on combinations of condition codes
SetX Condition Descriptionsete ZF Equal / Zerosetne ~ZF Not Equal / Not Zerosets SF Negativesetns ~SF Nonnegativesetg ~(SF^OF)&~ZF Greater (Signed)
setge ~(SF^OF) Greater or Equal (Signed)
setl (SF^OF) Less (Signed)setle (SF^OF)|ZF Less or Equal (Signed)seta ~CF&~ZF Above (unsigned)setb CF Below (unsigned)
58
movl 12(%ebp),%eax # eax = ycmpl %eax,8(%ebp) # Compare x : ysetg %al # al = x > ymovzbl %al,%eax # Zero rest of %eax
Reading Condition Codes (Cont.)
SetX Instructions: Set single byte based on combination of condition
codes One of 8 addressable byte
registers Does not alter remaining 3 bytes Typically use movzbl to finish jobint gt (int x, int y){ return x > y;}
int gt (int x, int y){ return x > y;}
Body
%eax %ah %al
%ecx %ch %cl
%edx %dh %dl
%ebx %bh %bl
%esi
%edi
%esp
%ebp
59
Conditional branches and moves
60
Conditional branches and moves
61
Jumping jX Instructions
Jump to different part of code depending on condition codes
jX Condition Descriptionjmp 1 Unconditional
je ZF Equal / Zero
jne ~ZF Not Equal / Not Zero
js SF Negative
jns ~SF Nonnegative
jg ~(SF^OF)&~ZF Greater (Signed)
jge ~(SF^OF) Greater or Equal (Signed)
jl (SF^OF) Less (Signed)
jle (SF^OF)|ZF Less or Equal (Signed)
ja ~CF&~ZF Above (unsigned)
jb CF Below (unsigned)
62
Conditional Branch Example
int absdiff(int x, int y){ int result; if (x > y) { result = x-y; } else { result = y-x; } return result;}
int absdiff(int x, int y){ int result; if (x > y) { result = x-y; } else { result = y-x; } return result;}
Conditional Branch Example (Cont.)int goto_ad(int x, int y){ int result; if (x <= y) goto Else; result = x-y; goto Exit;Else: result = y-x;Exit: return result;}
int goto_ad(int x, int y){ int result; if (x <= y) goto Else; result = x-y; goto Exit;Else: result = y-x;Exit: return result;}
C allows “goto” as means of transferring control Closer to machine-level
Conditional Branch Example (Cont.)int goto_ad(int x, int y){ int result; if (x <= y) goto Else; result = x-y; goto Exit;Else: result = y-x;Exit: return result;}
int goto_ad(int x, int y){ int result; if (x <= y) goto Else; result = x-y; goto Exit;Else: result = y-x;Exit: return result;}
Conditional Branch Example (Cont.)int goto_ad(int x, int y){ int result; if (x <= y) goto Else; result = x-y; goto Exit;Else: result = y-x;Exit: return result;}
int goto_ad(int x, int y){ int result; if (x <= y) goto Else; result = x-y; goto Exit;Else: result = y-x;Exit: return result;}
Conditional Branch Example (Cont.)int goto_ad(int x, int y){ int result; if (x <= y) goto Else; result = x-y; goto Exit;Else: result = y-x;Exit: return result;}
int goto_ad(int x, int y){ int result; if (x <= y) goto Else; result = x-y; goto Exit;Else: result = y-x;Exit: return result;}
Init; if (!Test) goto done; do Body Update while(Test);done:
Init; if (!Test) goto done; do Body Update while(Test);done:
Init; if (!Test) goto done;loop: Body Update if (Test) goto loop;done:
Init; if (!Test) goto done;loop: Body Update if (Test) goto loop;done:
78
C Code
“For” Loop Conversion Example
Initial test can be optimized away
#define WSIZE 8*sizeof(int)int pcount_for(unsigned x) { int i; int result = 0; for (i = 0; i < WSIZE; i++) { unsigned mask = 1 << i; result += (x & mask) != 0; } return result;}
#define WSIZE 8*sizeof(int)int pcount_for(unsigned x) { int i; int result = 0; for (i = 0; i < WSIZE; i++) { unsigned mask = 1 << i; result += (x & mask) != 0; } return result;}
Goto Version
int pcount_for_gt(unsigned x) { int i; int result = 0; i = 0; if (!(i < WSIZE)) goto done; loop: { unsigned mask = 1 << i; result += (x & mask) != 0; } i++; if (i < WSIZE) goto loop; done: return result;}
int pcount_for_gt(unsigned x) { int i; int result = 0; i = 0; if (!(i < WSIZE)) goto done; loop: { unsigned mask = 1 << i; result += (x & mask) != 0; } i++; if (i < WSIZE) goto loop; done: return result;}
Init
!Test
Body
UpdateTest
79
CPU
Assembly Programmer’s View
Programmer-Visible State PC: Program counter
Address of next instruction Called “EIP” (IA32) or “RIP” (x86-64)
Register file Heavily used program data
Condition codes Store status information about most
recent arithmetic operation Used for conditional branching
PCRegisters
Memory
CodeDataStack
Addresses
Data
InstructionsConditionCodes
Memory Byte addressable array Code and user data Stack to support procedures
“zip_dig pgh[4]” equivalent to “int pgh[4][5]” Variable pgh: array of 4 elements, allocated contiguously Each element is an array of 5 int’s, allocated contiguously
Important: “Row-Major” ordering of all elements guaranteed