孟宁 linux,操作系统分析所需的相关基础知识 Foundations For Hacking Linux based on X86/Linux 孟宁…...

Foundations For Hacking Linuxbased on X86/Linux

0512-68839303

E-mailmengning@ustc.edu.cn

http://staff.ustc.edu.cn/~mengning

188504

20135

Agenda

CC

C

C

espstack pointer

ebpbase pointer

push432

pop4

ebpC

esp

ebp

esp

cs : eip

/cs : eip

callcs : eipcs : eip

retcs : eipcs : eip

//

call target

//pushl %ebpmovl %esp, %ebp

//movl %ebp,%esppopl %ebp ret

do sth.

call

1eipA

2eip

Aeip

call xxx

call

callcs : eipcallcs : eipxxx

xxx

pushl %ebp

movl %esp, %ebp

xxx

movl %ebp,%esp

popl %ebp

ret

esp

ebp

cs : eip

esp

ebp

esp

ebp

esp

test.c

C

mainp1p2

gcc g test.ctest

objdump Stest

p2

testp2

int p2(int x,int y)

{

push %ebp

mov %esp,%ebp

return x+y;

mov 0xc(%ebp),%eax

add 0x8(%ebp),%eax

}

movl %ebp,%esp

pop %ebp

ret

ebp

esp

ebp

esp

ebp

y

x

p2

z=p2(x,y);

pushl 0xfffffff8(%ebp)

pushl 0xfffffff4(%ebp)

call 804839b

add $0x8,%esp

mov %eax,0xfffffffc(%ebp)

printf("%d=%d+%d\n",z,x,y);

pushl 0xfffffff8(%ebp)

pushl 0xfffffff4(%ebp)

pushl 0xfffffffc(%ebp)

push $0x8048510

call 80482b0

p2main

esp

ebp

y

x

ebp

cs:eip

esp

ebp

esp

esp

main

int main(void)

{

push %ebp

mov %esp,%ebp

sub $0x18,%esp

char c='a';

movb $0x61,0xfffffff3(%ebp)

int x,y,z;

x=1;

movl $0x1,0xfffffff4(%ebp)

y=2;

movl $0x2,0xfffffff8(%ebp)

ebp

ebp

esp

ebp

esp

esp

c=a

x=1

y=2

eip

eip

eip

eip

main

p1(c)

p2(x,y)

p1

p2

main

p2

p1

eip

esp

main

c

eip

eip

eip

p1

esp

eip

eip

eip

xy

eip

p2

eip

mainp1p2

mainp2p2p1

eip

eip

eip

eip

main

p2(x,y)

p1

p2

p1(c)

main

p2

p1

eip

esp

main

esp

eip

eip

xy

eip

p2

eip

eip

eip

eip

c

eip

p1

esp

mainp1p2

C

#include

int main()

{

/* val1+val2=val3 */

unsigned int val1 = 1;

unsigned int val2 = 2;

unsigned int val3 = 0;

printf("val1:%d,val2:%d,val3:%d\n",val1,val2,val3);

asm volatile(

"movl $0,%%eax\n\t" /* clear %eax to 0*/

"addl %1,%%eax\n\t" /* %eax += val1 */

"addl %2,%%eax\n\t" /* %eax += val2 */

"movl %%eax,%0\n\t" /* val2 = %eax*/

: "=m" (val3) /* output =m mean only write output memory variable*/

: "c" (val1),"d" (val2)/* input c or d mean %ecx/%edx*/

);

printf("val1:%d+val2:%d=val3:%d\n",val1,val2,val3);

return 0;

}

int (*f) (int x); /* */

f=func; /* funcf */

void FileFunc()

{

printf(FileFunc\n);

}

void EditFunc()

{

printf(EditFunc\n);

}

void (*funcp)();

void FileFunc();

void EditFunc();

main()

{

funcp=FileFunc;

(*funcp)();

funcp=&EditFunc;

funcp();

}

CPUCPUintel x86 CPU0-3Linux03

csCPUcs:eipcseipLinux0xc00000000x000000000xbfffffff

:

vs

/int

cs:eip

324GBLinux3G3G4G

4KB

Linux

3G//

Homework

CC32x86Linux

Tony Hoare

Linux