x86函数调用栈分析

x86函数调用栈分析

1、环境

win10 + mingw

2、基础知识

寄存器	作用
rsp	栈指针，指向栈顶(低地址)

代码

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int add2(int b1, int b2)
{
    return b1 + b2;
}
​
int add6(int a1, int a2, int a3, int a4, int a5, int a6)
{
    int sum = a1 + a2 + a3 + a4;
    sum += add2(a5, a6);
    return sum;
}
​
void hack()
{
    printf("hack\n");
}
​
int main()
{
    int sum = add6(1, 2, 3, 4, 5, 6);
    printf("sum = %d\n", sum);
    return 0;
}
​

1)、查找add6函数栈的返回函数的地址

0x61fdd8: 0x00000000004015fb

2)、add6函数栈的返回函数的地址替换为hack的地址

PS D:\0Test> gdb .\stack.o  
GNU gdb (GDB) 8.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-w64-mingw32".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from .\stack.o...done.
(gdb) b main
Breakpoint 1 at 0x4015d0: file .\stack.cpp, line 23.
(gdb) r
Starting program: D:\0Test\stack.o 
[New Thread 24324.0x5f98]
[New Thread 24324.0x50ac]
[New Thread 24324.0x4d50]
[New Thread 24324.0x4484]
​
Thread 1 hit Breakpoint 1, main () at .\stack.cpp:23
warning: Source file is more recent than executable.
23          int sum = add6(1, 2, 3, 4, 5, 6);
(gdb) s
add6 (a1=1, a2=2, a3=3, a4=4, a5=5, a6=6) at .\stack.cpp:11
11          int sum = a1 + a2 + a3 + a4;
(gdb) info registers rsp
rsp            0x61fda0 0x61fda0
(gdb) info registers rbp
rbp            0x61fdd0 0x61fdd0
(gdb) disassemble 
Dump of assembler code for function add6(int, int, int, int, int, int):
   0x0000000000401564 <+0>:     push   %rbp
   0x0000000000401565 <+1>:     mov    %rsp,%rbp
   0x0000000000401568 <+4>:     sub    $0x30,%rsp
   0x000000000040156c <+8>:     mov    %ecx,0x10(%rbp)
   0x000000000040156f <+11>:    mov    %edx,0x18(%rbp)
   0x0000000000401572 <+14>:    mov    %r8d,0x20(%rbp)
   0x0000000000401576 <+18>:    mov    %r9d,0x28(%rbp)
=> 0x000000000040157a <+22>:    mov    0x10(%rbp),%edx
   0x000000000040157d <+25>:    mov    0x18(%rbp),%eax
   0x0000000000401580 <+28>:    add    %eax,%edx
   0x0000000000401582 <+30>:    mov    0x20(%rbp),%eax
   0x0000000000401585 <+33>:    add    %eax,%edx
   0x0000000000401587 <+35>:    mov    0x28(%rbp),%eax
   0x000000000040158a <+38>:    add    %edx,%eax
   0x000000000040158c <+40>:    mov    %eax,-0x4(%rbp)
   0x000000000040158f <+43>:    mov    0x38(%rbp),%edx
   0x0000000000401592 <+46>:    mov    0x30(%rbp),%eax
   0x0000000000401595 <+49>:    mov    %eax,%ecx
   0x0000000000401597 <+51>:    callq  0x401550 <add2(int, int)>
   0x000000000040159c <+56>:    add    %eax,-0x4(%rbp)
   0x000000000040159f <+59>:    mov    -0x4(%rbp),%eax
   0x00000000004015a2 <+62>:    add    $0x30,%rsp
   0x00000000004015a6 <+66>:    pop    %rbp
   0x00000000004015a7 <+67>:    retq
End of assembler dump.
(gdb) disassemble main
Dump of assembler code for function main():
   0x00000000004015c3 <+0>:     push   %rbp
   0x00000000004015c4 <+1>:     mov    %rsp,%rbp
   0x00000000004015c7 <+4>:     sub    $0x40,%rsp
   0x00000000004015cb <+8>:     callq  0x4016d0 <__main>
   0x00000000004015d0 <+13>:    movl   $0x6,0x28(%rsp)
   0x00000000004015d8 <+21>:    movl   $0x5,0x20(%rsp)
   0x00000000004015e0 <+29>:    mov    $0x4,%r9d
   0x00000000004015e6 <+35>:    mov    $0x3,%r8d
   0x00000000004015ec <+41>:    mov    $0x2,%edx
   0x00000000004015f1 <+46>:    mov    $0x1,%ecx
   0x00000000004015f6 <+51>:    callq  0x401564 <add6(int, int, int, int, int, int)>
   0x00000000004015fb <+56>:    mov    %eax,-0x4(%rbp)
   0x00000000004015fe <+59>:    mov    -0x4(%rbp),%eax
   0x0000000000401601 <+62>:    mov    %eax,%edx
   0x0000000000401603 <+64>:    lea    0x29fb(%rip),%rcx        # 0x404005
   0x000000000040160a <+71>:    callq  0x402b08 <printf>
   0x000000000040160f <+76>:    mov    $0x0,%eax
   0x0000000000401614 <+81>:    add    $0x40,%rsp
   0x0000000000401618 <+85>:    pop    %rbp
   0x0000000000401619 <+86>:    retq
End of assembler dump.
(gdb) x /10gx 0x61fda0
0x61fda0:       0x0000000000000000      0x0000000000000000
0x61fdb0:       0x0000000000b12bc0      0x00007ffebfcfaa86
0x61fdc0:       0x0000000000000008      0x0000000000000000
0x61fdd0:       0x000000000061fe20      0x00000000004015fb
0x61fde0:       0x0000000000000001      0x0000000000000002
(gdb) x /gx 0x61fdd8
0x61fdd8:       0x00000000004015fb
(gdb) info symbol 0x00000000004015fb
main + 56 in section .text of D:\0Test\stack.o
(gdb) info address hack
Symbol "hack()" is a function at address 0x4015a8.
(gdb) set {long long int}0x61fdd8=0x00000000004015a8
(gdb) c
Continuing.
[New Thread 23380.0x5edc]
​
Thread 1 hit Breakpoint 2, hack () at .\stack.cpp:18
18          printf("hack\n");
(gdb) c
Continuing.
hack
​
Thread 1 received signal SIGSEGV, Segmentation fault.
0x0000000000000001 in ?? ()