Peter Mawhorter
%rbx
, %rsp
, %rbp
, plus
%r12
-15
%rax
, %rcx
, %rdx
,
%rsi
, %rdi
, plus
%r8
-11
call
and ret
%rip
is the Instruction
Pointer register (not general)call
does the following:
%rip
address%rsp
down 8
bytes%rip
gcc
worry about that)ret
does the following:
%rsp
into
%rip
%rsp
to finish popping that valuecall
and ret
call
nor ret
modifies registers
except %rsp
/%rip
.
%rax
%rax
%rsp
must be a multiple of 16 when
call
happensNote: in 64-bit mode (which we are always in)
call
/callq
and
ret
/retq
makes no difference.
%rsp
%rbp
as a base while %rsp
moves aroundpush
and pop
to store values easily
push
moves %rsp
down + stores a valuepop
moves %rsp
up + loads a valuepushq
store different # of bytes%rsp
and/or %rbp
into registers
like %rsi
can be a sign that a pointer to stack-allocated
memory is being sent to another function that will fill it in..data
prompt: .string "Enter a number: "
unused: .string "this will never appear\n"
.text
bad:
sub $0x10, %rsp
mov $prompt, %rdi
call printf
movq $0, (%rsp)
mov %rsp, %rdi
call gets
mov (%rsp), %rax
addq $0, %rsp // not sure why we need this
addq $0x10, %rsp
ret
.global main
main:
call bad
mov $0, %rax
ret
never:
sub $8, %rsp
mov $unused, %rdi
call printf
add $8, %rsp
ret
gdb
:
disas
to get the address of the function you
wantx /8gx $rsp
to see what’s on the stackinfo reg rsp
to see %rsp
address
directlydisas
for current function to see how far
%rsp
has moved from return address = how much padding to
include0123456789abcdefp^Q@
0
… f
= 16 bytesp
→ 0x70
in ASCII^Q
→ 0x11
@
→ 0x40
(401170 in little-endian order)
never
was now assembled at 0x40116c
l
→ 0x6c
^Q
→ 0x11
@
→ 0x40
0123456789abcdefl^Q@
Use hex2raw.bin
instead of trying to type in your
exploits!
.data
prompt: .string "Enter a number: "
unused: .string "this will never appear\n"
.text
bad:
sub $0x10, %rsp
mov $prompt, %rdi
call printf
movq $0, (%rsp)
mov %rsp, %rdi
call gets
mov (%rsp), %rax
addq $0, %rsp // not sure why we need this
addq $0x10, %rsp
ret
.global main
main:
call bad
mov $0, %rax
ret
never:
sub $8, %rsp
mov $unused, %rdi
call printf
add $8, %rsp
ret