Comments (2)
Thank you for your question. I was able to reproduce the book listings with -fno-stack-protector
flag. Apparently this should be added to errata, which I am doing right now.
-
The strange things at you are seeing at 0x40055d-0x40056a and 0x400588-0x400597 are parts of the stack buffer overflow protection mechanism, explained in 14.8.1. See how this value from fs:0x28 is being placed next to the return address and old
rbp
value: this is a security cookie, if it gets overwritten the program craches by calling400420 <__stack_chk_fail@plt>
. -
rsp
is not subtracted enough because of the red zone, which is explained in 14.1.4.
The red zone is an area of 128 bytes that spans from rsp to lower addresses. It relaxes the rule “no data below rsp”; it is safe to allocate data there and it will not be overwritten by system calls or interrupts.
So, 0xf90 is decimal 3984, 3984 + 128 = 4112 = 0x1010 so that is how much place we really get if we subtract 0xf90 from rsp
. Your listing shows a close enough number: 0x1020, which is different by 16. Why so?
You compiled the code with stack protection implicitly turned on. Because of that, we need an extra 8 bytes in stack immediately next to old rbp
value in order to store the security cookie (the bloat you mentioned).
We subtract a bit more to keep rsp
well aligned in case of future calls, such as call 400420 <__stack_chk_fail@plt>
. When interacting with C code, the stack should usually be 16-bit aligned (a part of calling convention described in ABI).
When maximum
is being called, the stack is 16-bit aligned. Then we do the following:
call
rsp -= 8push rbp
rsp -= 8- sub rsp, x
Werex
equal to 0x1018 (enough place for locals + security cookie), we would have broken the 16-bit alignment. It leads to undefined behavior when calling<__stack_chk_fail@plt>
.
In case of stack protection turned off, this function performs no calls (leaf function), and we don't need to keep rsp
aligned.
from low-level-programming.
Thanks for explaning this.
from low-level-programming.
Related Issues (20)
- Debian Virtual Machine: git clone: could not resolve host github.com HOT 2
- Question / Answers: Combined HOT 1
- Question 44 typo HOT 2
- SSH into VM not working HOT 2
- typo in errata HOT 2
- error when run on Mac HOT 1
- VirtualBox display resolution HOT 3
- Q34 HOT 1
- Q39 HOT 1
- Q40 HOT 1
- Q70 HOT 1
- Assignment: Dictionary
- Section 1.3.1 HOT 2
- Docker setup HOT 3
- Missing answers to questions HOT 1
- There is no need in having `pyc` files present in the repository
- Python scripts compatibility
- Virtual Machine
- Question 22 HOT 2
- Nasm can't create output file
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from low-level-programming.