深入理解計(jì)算機(jī)系統(tǒng)_復(fù)習(xí)_清華(文件)
【正文】 string contains byte representation of executable code ? Overwrite return address with address of buffer ? When bar() executes ret, will jump to exploit code int bar() { char buf[64]。 ... } Stack after call to gets() B return address A foo stack frame bar stack frame B exploit code pad data written by gets() 。 ... return ...。 } *sp。 } *up。lowest 3 bits of address must be 0002 187。lowest 2 bits of address must be 002 187。 instruction sets): 187。 double v。 jTnPk += n。 int jTnPk = k。 return result。 int result = 0。 return result。 int result = 0。 } %ecx = dig %eax = index leal 0(,%ecx,4),%edx 4*dig leal (%eax,%eax,4),%eax 5*index movl pgh(%edx,%eax,4),%eax *(pgh + 4*dig + 20*index) Array Element Accesses ? Similar C references Nested Array ? Element at Mem[pgh+20*index+4*dig] ? Different address putation MultiLevel Array ? Element at Mem[Mem[univ+4*index]+4*dig] int get_pgh_digit (int index, int dig) { return pgh[index][dig]。 ? 2D array of data type T ? R rows, C columns ? Type T element requires K bytes Array Size ? R * C * K bytes Arrangement ? RowMajor Ordering A[0][0] A[0][C1] A[R1][0] ? ? ? ? ? ? A[R1][C1] ? ? ? ? ? ? int A[R][C]。a[i+1] jmp swap swap() Interesting Features of Stack Frame Allocate Entire Frame at Once ? All stack accesses can be relative to %rsp ? Do by decrementing stack pointer ? Can delay allocation, since safe to temporarily use red zone Simple Deallocation ? Increment stack pointer Basic Data Types Integral ? Stored amp。a[i], amp。a[i+1] call swap swap() incq scount(%rip) scount++。a[i+1])。 } swap_a: movq (%rdi), %rax movq %rax, 24(%rsp) movq (%rsi), %rax movq %rax, 16(%rsp) movq 16(%rsp), %rax movq %rax, (%rdi) movq 24(%rsp), %rax movq %rax, (%rsi) ret rtn Ptr unused %rsp ?8 loc[1] loc[0] ?16 ?24 x8664 NonLeaf without Stack Frame ? No values held while swap being invoked ? No callee save registers needed long scount = 0。 loc[0] = *xp。 goto middle。 Test。 done: While Version For Version DoWhile Version Init。 } Goto Version Init。 } Gcc New Conditional Branch Example Implementing Loops IA32 ? All loops translated into form based on “dowhile” x8664 ? Also make use of “jump to middle” Why the Difference ? IA32 piler developed for machine where all operations costly ? x8664 piler developed for machine where unconditional branches incur (almost) no overhead “For”? “While”? “DoWhile” for (Init。 } absdiff: pushl %ebp movl %esp, %ebp movl 8(%ebp), %edx movl 12(%ebp), %eax cmpl %eax, %edx jle .L7 subl %eax, %edx movl %edx, %eax .L8: leave ret .L7: subl %edx, %eax jmp .L8 Body1 Set Up Finish Body2 pushl %ebp movl %esp, %ebp pushl %ebx movl 8(%ebp), %ecx movl 12(%ebp), %edx movl %ecx, %ebx subl %edx, %ebx movl %edx, %eax subl %ecx, %eax cmpl %edx, %ecx cmovg %ebx, %eax popl %ebx popl %ebp ret int absdiff( int x, int y) { int result。~ZF A bov e ( uns igned )setb CF B elo w (unsigned)SetX Instructions ? Set single byte based on binations of condition codes Conditional Branch Example int absdiff( int x, int y) { int result。 *xp = t1。 Src,Dest Indexed Addressing Modes Most General Form D(Rb,Ri,S) Mem[Reg[Rb]+S*Reg[Ri]+ D] ? D: Constant “displacement” ? Rb: Base register: Any of 8 integer registers ? Ri: Index register: Any, except for %esp ?Unlikely you’d use %ebp, either ? S: Scale: 1, 2, 4, or 8 Special Cases (Rb,Ri) Mem[Reg[Rb]+Reg[Ri]] D(Rb,Ri) Mem[Reg[Rb]+Reg[Ri]+D] (Rb,Ri,S) Mem[Reg[Rb]+S*Reg[Ri]] Address Computation Instruction leal Src,Dest ?Src is address mode expression ?Set Dest to address denoted by expression Uses ?Computing addresses without a memory reference ? ., translation of p = amp。 movl $147,(%eax) *p = 147。 ? 2/3 == 2/ ? d ??? ((d*2) ) ? d f ??? f d ? d * d = ? (d+f)d == f int x = …。Single precision: 127 (Exp: 1…254, E: 126…127) 187。 int y = bar()。 7 == 7 ??? (x30) 0 ? ux 1 ? x y ??? x y ? x * x = 0 ? x 0 amp。 uy = (unsigned) ty。, ||, ! View 0 as ―False‖ Anything nonzero as ―True‖ Always return 0 or 1 Early termination Shift Operations ?Logic
研究報(bào)告相關(guān)推薦
鄂ICP備17016276號-1