《深入理解计算机系统》 家庭作业3.38

/* Bomb program that is solved using a buffer overflow attack */

#include <stdio.h>;
#include <stdlib.h>;
#include <ctype.h>;

/* Like gets, except that characters are typed as pairs of hex digits.
   Nondigit characters are ignored.  Stops when encounters newline */
char *getxs(char *dest)
{
  int c;
  int even = 1; /* Have read even number of digits */
  int otherd = 0; /* Other hex digit of pair */
  char *sp = dest;
  while ((c = getchar()) != EOF && c != '\n') {
    if (isxdigit(c)) {
      int val;
      if ('0' <= c && c <= '9')
        val = c - '0';
      else if ('A' <= c && c <= 'F')
        val = c - 'A' + 10;
      else
        val = c - 'a' + 10;
      if (even) {
        otherd = val;
        even = 0;
      } else {
        *sp++ = otherd * 16 + val;
        even = 1;
      }
    }
  }
  *sp++ = '\0';
  return dest;
}

/* $begin getbuf-c */
int getbuf()
{
    char buf[12];
    getxs(buf);
    return 1;
}

void test()
{
  int val;
  printf("Type Hex string:");
  val = getbuf();
  printf("getbuf returned 0x%x\n", val);
}
/* $end getbuf-c */

int main()
{

  int buf[16];
  /* This little hack is an attempt to get the stack to be in a
     stable position
  */
  int offset = (((int) buf) & 0xFFF);
  int *space = (int *) alloca(offset);
  *space = 0; /* So that don't get complaint of unused variable */
  test();
  return 0;
}

 题目的要求是，在getbuf函数中也许“显然”地会返回1，通过输入一个数据使这个函数返回0xdeadbeef，就是在test函数中地printf中打印地是0xdeadbeef.

Using built-in specs.
Target: i486-linux-gnu
Configured with: ../src/configure -v --enable-languages=c,c++,fortran,objc,obj-c++,treelang --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --with-gxx-include-dir=/usr/include/c++/4.2 --program-suffix=-4.2 --enable-clocale=gnu --enable-libstdcxx-debug --enable-objc-gc --enable-mpfr --enable-targets=all --enable-checking=release --build=i486-linux-gnu --host=i486-linux-gnu --target=i486-linux-gnu
Thread model: posix
gcc version 4.2.4 (Ubuntu 4.2.4-1ubuntu3)

GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu". 

bomb: file format elf32-i386

Disassembly of section .init:

0804832c <_init>:
804832c: 55 push %ebp
804832d: 89 e5 mov %esp,%ebp
804832f: 53 push %ebx
8048330: 83 ec 04 sub $0x4,%esp
8048333: e8 00 00 00 00 call 8048338 <_init+0xc>
8048338: 5b pop %ebx
8048339: 81 c3 ac 14 00 00 add $0x14ac,%ebx
804833f: 8b 93 fc ff ff ff mov -0x4(%ebx),%edx
8048345: 85 d2 test %edx,%edx
8048347: 74 05 je 804834e <_init+0x22>
8048349: e8 2e 00 00 00 call 804837c <__gmon_start__@plt>
804834e: e8 dd 00 00 00 call 8048430 <frame_dummy>
8048353: e8 28 03 00 00 call 8048680 <__do_global_ctors_aux>
8048358: 58 pop %eax
8048359: 5b pop %ebx
804835a: c9 leave
804835b: c3 ret
Disassembly of section .plt:

0804835c <getchar@plt-0x10>:
804835c: ff 35 e8 97 04 08 pushl 0x80497e8
8048362: ff 25 ec 97 04 08 jmp *0x80497ec
8048368: 00 00 add %al,(%eax)
...

0804836c <getchar@plt>:
804836c: ff 25 f0 97 04 08 jmp *0x80497f0
8048372: 68 00 00 00 00 push $0x0
8048377: e9 e0 ff ff ff jmp 804835c <_init+0x30>

0804837c <__gmon_start__@plt>:
804837c: ff 25 f4 97 04 08 jmp *0x80497f4
8048382: 68 08 00 00 00 push $0x8
8048387: e9 d0 ff ff ff jmp 804835c <_init+0x30>

0804838c <__libc_start_main@plt>:
804838c: ff 25 f8 97 04 08 jmp *0x80497f8
8048392: 68 10 00 00 00 push $0x10
8048397: e9 c0 ff ff ff jmp 804835c <_init+0x30>

0804839c <__ctype_b_loc@plt>:
804839c: ff 25 fc 97 04 08 jmp *0x80497fc
80483a2: 68 18 00 00 00 push $0x18
80483a7: e9 b0 ff ff ff jmp 804835c <_init+0x30>

080483ac <printf@plt>:
80483ac: ff 25 00 98 04 08 jmp *0x8049800
80483b2: 68 20 00 00 00 push $0x20
80483b7: e9 a0 ff ff ff jmp 804835c <_init+0x30>

080483bc <__stack_chk_fail@plt>:
80483bc: ff 25 04 98 04 08 jmp *0x8049804
80483c2: 68 28 00 00 00 push $0x28
80483c7: e9 90 ff ff ff jmp 804835c <_init+0x30>
Disassembly of section .text:

080483d0 <_start>:
80483d0: 31 ed xor %ebp,%ebp
80483d2: 5e pop %esi
80483d3: 89 e1 mov %esp,%ecx
80483d5: 83 e4 f0 and $0xfffffff0,%esp
80483d8: 50 push %eax
80483d9: 54 push %esp
80483da: 52 push %edx
80483db: 68 10 86 04 08 push $0x8048610
80483e0: 68 20 86 04 08 push $0x8048620
80483e5: 51 push %ecx
80483e6: 56 push %esi
80483e7: 68 87 85 04 08 push $0x8048587
80483ec: e8 9b ff ff ff call 804838c <__libc_start_main@plt>
80483f1: f4 hlt
80483f2: 90 nop
80483f3: 90 nop
80483f4: 90 nop
80483f5: 90 nop
80483f6: 90 nop
80483f7: 90 nop
80483f8: 90 nop
80483f9: 90 nop
80483fa: 90 nop
80483fb: 90 nop
80483fc: 90 nop
80483fd: 90 nop
80483fe: 90 nop
80483ff: 90 nop

08048400 <__do_global_dtors_aux>:
8048400: 55 push %ebp
8048401: 89 e5 mov %esp,%ebp
8048403: 83 ec 08 sub $0x8,%esp
8048406: 80 3d 14 98 04 08 00 cmpb $0x0,0x8049814
804840d: 74 0c je 804841b <__do_global_dtors_aux+0x1b>
804840f: eb 1c jmp 804842d <__do_global_dtors_aux+0x2d>
8048411: 83 c0 04 add $0x4,%eax
8048414: a3 10 98 04 08 mov %eax,0x8049810
8048419: ff d2 call *%edx
804841b: a1 10 98 04 08 mov 0x8049810,%eax
8048420: 8b 10 mov (%eax),%edx
8048422: 85 d2 test %edx,%edx
8048424: 75 eb jne 8048411 <__do_global_dtors_aux+0x11>
8048426: c6 05 14 98 04 08 01 movb $0x1,0x8049814
804842d: c9 leave
804842e: c3 ret
804842f: 90 nop

08048430 <frame_dummy>:
8048430: 55 push %ebp
8048431: 89 e5 mov %esp,%ebp
8048433: 83 ec 08 sub $0x8,%esp
8048436: a1 0c 97 04 08 mov 0x804970c,%eax
804843b: 85 c0 test %eax,%eax
804843d: 74 12 je 8048451 <frame_dummy+0x21>
804843f: b8 00 00 00 00 mov $0x0,%eax
8048444: 85 c0 test %eax,%eax
8048446: 74 09 je 8048451 <frame_dummy+0x21>
8048448: c7 04 24 0c 97 04 08 movl $0x804970c,(%esp)
804844f: ff d0 call *%eax
8048451: c9 leave
8048452: c3 ret
8048453: 90 nop

08048454 <getxs>:
8048454: 55 push %ebp
8048455: 89 e5 mov %esp,%ebp
8048457: 83 ec 28 sub $0x28,%esp
804845a: c7 45 f8 01 00 00 00 movl $0x1,-0x8(%ebp)
8048461: c7 45 f4 00 00 00 00 movl $0x0,-0xc(%ebp)
8048468: 8b 45 08 mov 0x8(%ebp),%eax
804846b: 89 45 f0 mov %eax,-0x10(%ebp)
804846e: e9 8a 00 00 00 jmp 80484fd <getxs+0xa9>
8048473: e8 24 ff ff ff call 804839c <__ctype_b_loc@plt>
8048478: 8b 10 mov (%eax),%edx
804847a: 8b 45 fc mov -0x4(%ebp),%eax
804847d: 01 c0 add %eax,%eax
804847f: 8d 04 02 lea (%edx,%eax,1),%eax
8048482: 0f b7 00 movzwl (%eax),%eax
8048485: 0f b7 c0 movzwl %ax,%eax
8048488: 25 00 10 00 00 and $0x1000,%eax
804848d: 85 c0 test %eax,%eax
804848f: 74 6c je 80484fd <getxs+0xa9>
8048491: 83 7d fc 2f cmpl $0x2f,-0x4(%ebp)
8048495: 7e 11 jle 80484a8 <getxs+0x54>
8048497: 83 7d fc 39 cmpl $0x39,-0x4(%ebp)
804849b: 7f 0b jg 80484a8 <getxs+0x54>
804849d: 8b 45 fc mov -0x4(%ebp),%eax
80484a0: 83 e8 30 sub $0x30,%eax
80484a3: 89 45 ec mov %eax,-0x14(%ebp)
80484a6: eb 20 jmp 80484c8 <getxs+0x74>
80484a8: 83 7d fc 40 cmpl $0x40,-0x4(%ebp)
80484ac: 7e 11 jle 80484bf <getxs+0x6b>
80484ae: 83 7d fc 46 cmpl $0x46,-0x4(%ebp)
80484b2: 7f 0b jg 80484bf <getxs+0x6b>
80484b4: 8b 45 fc mov -0x4(%ebp),%eax
80484b7: 83 e8 37 sub $0x37,%eax
80484ba: 89 45 ec mov %eax,-0x14(%ebp)
80484bd: eb 09 jmp 80484c8 <getxs+0x74>
80484bf: 8b 45 fc mov -0x4(%ebp),%eax
80484c2: 83 e8 57 sub $0x57,%eax
80484c5: 89 45 ec mov %eax,-0x14(%ebp)
80484c8: 83 7d f8 00 cmpl $0x0,-0x8(%ebp)
80484cc: 74 0f je 80484dd <getxs+0x89>
80484ce: 8b 45 ec mov -0x14(%ebp),%eax
80484d1: 89 45 f4 mov %eax,-0xc(%ebp)
80484d4: c7 45 f8 00 00 00 00 movl $0x0,-0x8(%ebp)
80484db: eb 20 jmp 80484fd <getxs+0xa9>
80484dd: 8b 45 f4 mov -0xc(%ebp),%eax
80484e0: c1 e0 04 shl $0x4,%eax
80484e3: 89 c2 mov %eax,%edx
80484e5: 8b 45 ec mov -0x14(%ebp),%eax
80484e8: 8d 04 02 lea (%edx,%eax,1),%eax
80484eb: 89 c2 mov %eax,%edx
80484ed: 8b 45 f0 mov -0x10(%ebp),%eax
80484f0: 88 10 mov %dl,(%eax)
80484f2: 83 45 f0 01 addl $0x1,-0x10(%ebp)
80484f6: c7 45 f8 01 00 00 00 movl $0x1,-0x8(%ebp)
80484fd: e8 6a fe ff ff call 804836c <getchar@plt>
8048502: 89 45 fc mov %eax,-0x4(%ebp)
8048505: 83 7d fc ff cmpl $0xffffffff,-0x4(%ebp)
8048509: 74 0a je 8048515 <getxs+0xc1>
804850b: 83 7d fc 0a cmpl $0xa,-0x4(%ebp)
804850f: 0f 85 5e ff ff ff jne 8048473 <getxs+0x1f>
8048515: 8b 45 f0 mov -0x10(%ebp),%eax
8048518: c6 00 00 movb $0x0,(%eax)
804851b: 83 45 f0 01 addl $0x1,-0x10(%ebp)
804851f: 8b 45 08 mov 0x8(%ebp),%eax
8048522: c9 leave
8048523: c3 ret

08048524 <getbuf>:
8048524: 55 push %ebp
8048525: 89 e5 mov %esp,%ebp
8048527: 83 ec 18 sub $0x18,%esp
804852a: 65 a1 14 00 00 00 mov %gs:0x14,%eax
8048530: 89 45 fc mov %eax,-0x4(%ebp)
8048533: 31 c0 xor %eax,%eax
8048535: 8d 45 f0 lea -0x10(%ebp),%eax
8048538: 89 04 24 mov %eax,(%esp)
804853b: e8 14 ff ff ff call 8048454 <getxs>
8048540: b8 01 00 00 00 mov $0x1,%eax
8048545: 8b 55 fc mov -0x4(%ebp),%edx
8048548: 65 33 15 14 00 00 00 xor %gs:0x14,%edx
804854f: 74 05 je 8048556 <getbuf+0x32>
8048551: e8 66 fe ff ff call 80483bc <__stack_chk_fail@plt>
8048556: c9 leave
8048557: c3 ret

08048558 <test>:
8048558: 55 push %ebp
8048559: 89 e5 mov %esp,%ebp
804855b: 83 ec 18 sub $0x18,%esp
804855e: c7 04 24 d0 86 04 08 movl $0x80486d0,(%esp)
8048565: e8 42 fe ff ff call 80483ac <printf@plt>
804856a: e8 b5 ff ff ff call 8048524 <getbuf>
804856f: 89 45 fc mov %eax,-0x4(%ebp)
8048572: 8b 45 fc mov -0x4(%ebp),%eax
8048575: 89 44 24 04 mov %eax,0x4(%esp)
8048579: c7 04 24 e1 86 04 08 movl $0x80486e1,(%esp)
8048580: e8 27 fe ff ff call 80483ac <printf@plt>
8048585: c9 leave
8048586: c3 ret

08048587 <main>:
8048587: 8d 4c 24 04 lea 0x4(%esp),%ecx
804858b: 83 e4 f0 and $0xfffffff0,%esp
804858e: ff 71 fc pushl -0x4(%ecx)
8048591: 55 push %ebp
8048592: 89 e5 mov %esp,%ebp
8048594: 51 push %ecx
8048595: 83 ec 54 sub $0x54,%esp
8048598: 65 a1 14 00 00 00 mov %gs:0x14,%eax
804859e: 89 45 f8 mov %eax,-0x8(%ebp)
80485a1: 31 c0 xor %eax,%eax
80485a3: 8d 45 b0 lea -0x50(%ebp),%eax
80485a6: 25 ff 0f 00 00 and $0xfff,%eax
80485ab: 89 45 f4 mov %eax,-0xc(%ebp)
80485ae: 8b 45 f4 mov -0xc(%ebp),%eax
80485b1: 83 c0 0f add $0xf,%eax
80485b4: 83 c0 0f add $0xf,%eax
80485b7: c1 e8 04 shr $0x4,%eax
80485ba: c1 e0 04 shl $0x4,%eax
80485bd: 29 c4 sub %eax,%esp
80485bf: 89 65 a8 mov %esp,-0x58(%ebp)
80485c2: 8b 45 a8 mov -0x58(%ebp),%eax
80485c5: 83 c0 0f add $0xf,%eax
80485c8: c1 e8 04 shr $0x4,%eax
80485cb: c1 e0 04 shl $0x4,%eax
80485ce: 89 45 a8 mov %eax,-0x58(%ebp)
80485d1: 8b 55 a8 mov -0x58(%ebp),%edx
80485d4: 89 55 f0 mov %edx,-0x10(%ebp)
80485d7: 8b 45 f0 mov -0x10(%ebp),%eax
80485da: c7 00 00 00 00 00 movl $0x0,(%eax)
80485e0: e8 73 ff ff ff call 8048558 <test>
80485e5: b8 00 00 00 00 mov $0x0,%eax
80485ea: 8b 55 f8 mov -0x8(%ebp),%edx
80485ed: 65 33 15 14 00 00 00 xor %gs:0x14,%edx
80485f4: 74 05 je 80485fb <main+0x74>
80485f6: e8 c1 fd ff ff call 80483bc <__stack_chk_fail@plt>
80485fb: 8b 4d fc mov -0x4(%ebp),%ecx
80485fe: c9 leave
80485ff: 8d 61 fc lea -0x4(%ecx),%esp
8048602: c3 ret
8048603: 90 nop
8048604: 90 nop
8048605: 90 nop
8048606: 90 nop
8048607: 90 nop
8048608: 90 nop
8048609: 90 nop
804860a: 90 nop
804860b: 90 nop
804860c: 90 nop
804860d: 90 nop
804860e: 90 nop
804860f: 90 nop

08048610 <__libc_csu_fini>:
8048610: 55 push %ebp
8048611: 89 e5 mov %esp,%ebp
8048613: 5d pop %ebp
8048614: c3 ret
8048615: 8d 74 26 00 lea 0x0(%esi),%esi
8048619: 8d bc 27 00 00 00 00 lea 0x0(%edi),%edi

08048620 <__libc_csu_init>:
8048620: 55 push %ebp
8048621: 89 e5 mov %esp,%ebp
8048623: 57 push %edi
8048624: 56 push %esi
8048625: 53 push %ebx
8048626: e8 4f 00 00 00 call 804867a <__i686.get_pc_thunk.bx>
804862b: 81 c3 b9 11 00 00 add $0x11b9,%ebx
8048631: 83 ec 0c sub $0xc,%esp
8048634: e8 f3 fc ff ff call 804832c <_init>
8048639: 8d bb 18 ff ff ff lea -0xe8(%ebx),%edi
804863f: 8d 83 18 ff ff ff lea -0xe8(%ebx),%eax
8048645: 29 c7 sub %eax,%edi
8048647: c1 ff 02 sar $0x2,%edi
804864a: 85 ff test %edi,%edi
804864c: 74 24 je 8048672 <__libc_csu_init+0x52>
804864e: 31 f6 xor %esi,%esi
8048650: 8b 45 10 mov 0x10(%ebp),%eax
8048653: 89 44 24 08 mov %eax,0x8(%esp)
8048657: 8b 45 0c mov 0xc(%ebp),%eax
804865a: 89 44 24 04 mov %eax,0x4(%esp)
804865e: 8b 45 08 mov 0x8(%ebp),%eax
8048661: 89 04 24 mov %eax,(%esp)
8048664: ff 94 b3 18 ff ff ff call *-0xe8(%ebx,%esi,4)
804866b: 83 c6 01 add $0x1,%esi
804866e: 39 f7 cmp %esi,%edi
8048670: 75 de jne 8048650 <__libc_csu_init+0x30>
8048672: 83 c4 0c add $0xc,%esp
8048675: 5b pop %ebx
8048676: 5e pop %esi
8048677: 5f pop %edi
8048678: 5d pop %ebp
8048679: c3 ret

0804867a <__i686.get_pc_thunk.bx>:
804867a: 8b 1c 24 mov (%esp),%ebx
804867d: c3 ret
804867e: 90 nop
804867f: 90 nop

08048680 <__do_global_ctors_aux>:
8048680: 55 push %ebp
8048681: 89 e5 mov %esp,%ebp
8048683: 53 push %ebx
8048684: 83 ec 04 sub $0x4,%esp
8048687: a1 fc 96 04 08 mov 0x80496fc,%eax
804868c: 83 f8 ff cmp $0xffffffff,%eax
804868f: 74 12 je 80486a3 <__do_global_ctors_aux+0x23>
8048691: 31 db xor %ebx,%ebx
8048693: ff d0 call *%eax
8048695: 8b 83 f8 96 04 08 mov 0x80496f8(%ebx),%eax
804869b: 83 eb 04 sub $0x4,%ebx
804869e: 83 f8 ff cmp $0xffffffff,%eax
80486a1: 75 f0 jne 8048693 <__do_global_ctors_aux+0x13>
80486a3: 83 c4 04 add $0x4,%esp
80486a6: 5b pop %ebx
80486a7: 5d pop %ebp
80486a8: c3 ret
80486a9: 90 nop
80486aa: 90 nop
80486ab: 90 nop
Disassembly of section .fini:

080486ac <_fini>:
80486ac: 55 push %ebp
80486ad: 89 e5 mov %esp,%ebp
80486af: 53 push %ebx
80486b0: 83 ec 04 sub $0x4,%esp
80486b3: e8 00 00 00 00 call 80486b8 <_fini+0xc>
80486b8: 5b pop %ebx
80486b9: 81 c3 2c 11 00 00 add $0x112c,%ebx
80486bf: e8 3c fd ff ff call 8048400 <__do_global_dtors_aux>
80486c4: 59 pop %ecx
80486c5: 5b pop %ebx
80486c6: c9 leave
80486c7: c3 ret

mov $0xdeadbeef, %eax
mov $0x0804856f, %edx
jmp *%edx

gcc –c show.s
objdump –d show.o

【好玩】缓冲区溢出攻击实验
深入理解计算机系统 3.38题 选择自 lijingze2003 的 Blog