No Slide Title

Size: px

Start display at page:

Download "No Slide Title"

서헉 판
6 years ago
Views:

1 Copyright, 2017 Multimedia Lab., UOS 시스템프로그래밍 (Assembly Code and Calling Convention) Seong Jong Choi Multimedia Lab. Dept. of Electrical and Computer Eng. University of Seoul Seoul, Korea

2 MS VS++ Integrated Development Environment Language Sensitive Text Editor Preprocessor Compiler Linker Wizard Project (.dsp) A collection of all the necessary information to build a binary excutibles (.exe.dll) Files (source, header) Compile options Link options Work Space (.dsw) A collection of projects Seong Jong Choi Assembly Language-2

3 Build Process Editor hello.cpp Source Makefile Header files iostream.h Preprocessor Compiler 개발툴 By MS VC++ 사용자정의 Object file hello.obj Object files Linker Libraries mlibcewq.lib Debug Ver. hello.exe Release Ver hello.exe Seong Jong Choi Assembly Language-3

4 Assembly Code Project Setting -> C/C++ -> Category -> Listing files -> Listing file type -> Assembly, Machine Code, and Source Then, compile You ll see xxx.cod file in the debug directory Seong Jong Choi Assembly Language-4

5 Intel Registers Seong Jong Choi Assembly Language-5

6 Intel Fundamental Data Type Seong Jong Choi Assembly Language-6

7 Assembly code Instruction := operation [operand] [, operand] Examples Data movement: mov destaddr, eax Stack operation: pop eax Arithmetic, logic, comparison, etc Seong Jong Choi Assembly Language-7

8 Operand: Addressing Mode Immediate: Instruction에포함 Register Direct: Register의내용 Register indirect: Register 내용을메모리주소로사용 Memory Direct: Memory의내용 Memory indirect: Memory 내용을주소로사용 Index: address Seong Jong Choi Assembly Language-8

9 Data Movement Instruction mov destination, source _a$ = -4 mov dword ptr _a$[ebp], OAh Above two lines are equivalent to: mov dword ptr [ebp-4], 0Ah operation Operand: Immediate addressing Operand: index + register indirect addressing Seong Jong Choi Assembly Language-9

10 Stack Instructions PUSH 1. Decrement the stack pointer (ESP) 2. Then, transfer source to the stack indicated by ESP Ex) Push eax POP 1. Transfer data at the current top of stack (ESP) 2. Then, increment ESP Ex) Pop eax Stack Pointer(ESP) == POP 할데이터를가리킨다. FF F 번지 0 번지 Seong Jong Choi Assembly Language-10

11 Stack Instructions Seong Jong Choi Assembly Language-11

12 Assembly Debugging View -> Debug windows 에서 Register Memory Disassembly Seong Jong Choi Assembly Language-12

13 An Example /* simple.cpp demonstrating assembly language code generated by the compiler */ #include <windows.h> int sum(int x, int y); int WINAPI wsum(int x, int y); void main() { int a, b, c; a = 10; b = 20; c = a + b; c = sum(a,b); c = wsum(a,b); } int sum(int x, int y) { int z; z = x + y; return z; } int WINAPI wsum(int x, int y) { // 모든 Windows API 는 WINAPI 형식의함수이다. int z; z = x + y; return z; } Seong Jong Choi Assembly Language-13

14 Simple.cod File: 0 번지부터시작 ; 11 : a = 10; C source code c7 45 fc 0a Translated machine code mov DWORD PTR _a$[ebp], 10; aH Memory address for machine code Translated assembly code Seong Jong Choi Assembly Language-14

15 Disassembly Window: 실행시기계어의위치 (relocated) 11: a = 10; C source code mov dword ptr [ebp-4],0ah Memory address for machine code (Relocated) Translated assembly code (Disassemble) Seong Jong Choi Assembly Language-15

16 Function Call Caller ; 14 : c = sum(a,b); mov ecx, DWORD PTR _b$[ebp] push ecx mov edx, DWORD PTR _a$[ebp] push edx call?sum@@yahhh@z ; sum add esp, 8 mov DWORD PTR _c$[ebp], eax Callee ; COMDAT?sum@@YAHHH@Z _TEXT SEGMENT _x$ = 8 _y$ = 12 _z$ = -4?sum@@YAHHH@Z PROC NEAR ; sum, COMDAT ; 19 : int sum(int x, int y) { push mov sub push push push lea mov mov rep stosd ; 20 : int z; ; 21 : z = x + y; ebp ebp, esp esp, 68 ; H ebx esi edi edi, DWORD PTR [ebp-68] ecx, 17 ; H eax, ; cccccccch mov add mov eax, DWORD PTR _x$[ebp] eax, DWORD PTR _y$[ebp] DWORD PTR _z$[ebp], eax ; 22 : return z; mov eax, DWORD PTR _z$[ebp] ; 23 : } pop edi pop esi pop ebx mov esp, ebp pop ebp ret 0?sum@@YAHHH@Z ENDP ; sum _TEXT ENDS Seong Jong Choi Assembly Language-16

17 Before Function Call Assume: esp = n + 4 ebp = bbpp edi = ddii esi = ssii ebx = bbxx The above registers are used in the callee Seong Jong Choi Assembly Language-17

18 Function Call Caller ; 14 : c = sum(a,b); //esp = n+4 2 번째매개변수를 Stack 에저장 mov push mov push call ecx, DWORD PTR _b$[ebp] ecx edx, DWORD PTR _a$[ebp] edx?sum@@yahhh@z ; sum ESP b n n-4 n-8 n-12 add esp, 8 mov DWORD PTR _c$[ebp], eax Seong Jong Choi Assembly Language-18

19 Function Call - Caller ; 14 : c = sum(a,b); 1 번째매개변수를 Stack 에저장 mov ecx, DWORD PTR _b$[ebp] push ecx mov edx, DWORD PTR _a$[ebp] push edx call?sum@@yahhh@z ; sum add esp, 8 mov DWORD PTR _c$[ebp], eax ESP b n a n-4 n-8 n Seong Jong Choi Assembly Language-19

20 Function Call - Caller return addr: ; 14 : c = sum(a,b); mov ecx, DWORD PTR _b$[ebp] push ecx mov edx, DWORD PTR _a$[ebp] push edx call?sum@@yahhh@z ; sum add esp, 8 mov DWORD PTR _c$[ebp], eax Return address 를 Stack 에저장 1. Push returnaddr: 2. eip?sum@@yahh@z ESP b n a n-4 return addr n-8 n Seong Jong Choi Assembly Language-20

21 Function Call - Callee ; 19 : int sum(int x, int y) { push ebp; [ebp] = bbpp mov ebp, esp sub esp, 68 ; H push ebx push esi push edi lea edi, DWORD PTR [ebp-68] movecx, 17 ; H moveax, ; cccccccch rep stosd 함수안에서 ebp 를사용하기때문에, 우선 ebp 를 Stack 에저장 ESP b n a n-4 return addr n-8 bbpp n Seong Jong Choi Assembly Language-21

22 Function Call - Callee ; 19 : int sum(int x, int y) { push ebp; [ebp] = bbpp mov ebp, esp sub esp, 68 ; H push ebx push esi push edi lea edi, DWORD PTR [ebp-68] mov ecx, 17 ; H mov eax, ; cccccccch rep stosd Ebp 의값을현재의 esp 값으로지정 ebp = n-12 EBP ESP b n a n-4 return addr n-8 bbpp n Seong Jong Choi Assembly Language-22

23 Function Call - Callee ; 19 : int sum(int x, int y) { push ebp; [ebp] = bbpp mov ebp, esp sub esp, 68 ; H push ebx push esi push edi lea edi, DWORD PTR [ebp-68] mov ecx, 17 ; H mov eax, ; cccccccch rep stosd 함수내의지역변수를위한공간 (17 DWORD) 을 stack 에마련 esp = n-80 EBP ESP b n a n-4 return addr n-8 bbpp n-12 n-16 n Seong Jong Choi Assembly Language-23

24 Function Call - Callee ; 19 : int sum(int x, int y) { push ebp; [ebp] = bbpp mov ebp, esp sub esp, 68 ; H push ebx push esi push edi lea edi, DWORD PTR [ebp-68] mov ecx, 17 ; H mov eax, ; cccccccch rep stosd 함수에서사용할 Register 의내용을 Stack 에저장 EBP b n a n-4 return addr n-8 bbpp n-12 n-16 n-80 bbxx n-84 ssii n Seong Jong Choi Assembly Language-24 ESP ddii n-92

25 Function Call - Callee ; 19 : int sum(int x, int y) { push ebp; [ebp] = bbpp move bp, esp sub esp, 68 ; H push ebx push esi push edi lea edi, DWORD PTR [ebp-68] mov ecx, 17 ; H mov eax, ; cccccccch rep stosd for(i=0; i<ecx; i++) mov [edi + 4*i], eax for(i=0; i<17; i++) mov[(n-80) + 4*i], cccccccch 지역변수를위해확보한 Stack 의내용을모두 cccccccch 로저장 4 x 17 = Seong Jong Choi Assembly Language-25 EBP EDI ESP b n a n-4 return addr n-8 bbpp n-12 cccccccch n-16 cccccccch cccccccch n-80 bbxx n-84 ssii n-88 ddii n-92

26 Function Call - Callee _x$ = 8 _y$ = 12 _z$ = -4 ; 21 : z = x + y; a 와 b 를더해 [ebp-4] 에저장 EBP+12 EBP+8 b n a n-4 mov eax, DWORD PTR _x$[ebp] add eax, DWORD PTR _y$[ebp] mov DWORD PTR _z$[ebp], eax EBP EBP-4 return addr n-8 bbpp n-12 z = a+b n-16 cccccccch cccccccch n-80 bbxx n-84 ssii n Seong Jong Choi Assembly Language-26 ESP ddii n-92

27 Function Call - Callee ; 22 : return z; mov eax, DWORD PTR _z$[ebp] Return 할값을 eax 에저장 eax = a+b EBP+12 b n EBP+8 EBP EBP-4 a n-4 return addr n-8 bbpp n-12 z = a+b n-16 cccccccch cccccccch n-80 bbxx n-84 ssii n Seong Jong Choi Assembly Language-27 ESP ddii n-92

28 Function Call - Callee ; 23 : } 함수에서사용하기전 Register 값복원 pop edi pop esi pop ebx mov esp, ebp pop ebp ret 0 EBP ESP b n a n-4 return addr n-8 bbpp n-12 z = ssssssssh n-16 cccccccch cccccccch n-80 bbxx n-84 ssii n-88 ddii n Seong Jong Choi Assembly Language-28

29 Function Call - Callee ; 23 : } pop edi pop esi pop ebx mov esp, ebp pop ebp ret 0 지역변수를위해확보한공간을소멸 esp = ebp EBP ESP b n a n-4 return addr n-8 bbpp n-12 z = ssssssssh n-16 cccccccch cccccccch n-80 bbxx n-84 ssii n-88 ddii n Seong Jong Choi Assembly Language-29

30 Function Call - Callee ; 23 : } ebp 값을복원 ebp = bbpp pop edi pop esi pop ebx mov esp, ebp pop ebp ret 0 ESP b n a n-4 return addr n-8 bbpp n-12 z = ssssssssh n-16 cccccccch cccccccch n-80 bbxx n-84 ssii n-88 ddii n Seong Jong Choi Assembly Language-30

31 Function Call - Callee ; 23 : } caller 로다시가기위해 eip 값설정 1. pop eip; //eip return addr 2. esp = esp + 0 pop edi pop esi pop ebx mov esp, ebp pop ebp ret 0 ESP b n a n-4 return addr n-8 bbpp n-12 z = ssssssssh n-16 cccccccch cccccccch n-80 bbxx n-84 ssii n-88 ddii n Seong Jong Choi Assembly Language-31

32 Function Call - Caller ; 14 : c = sum(a,b); esp 를원래대로복원 return addr: mov ecx, DWORD PTR _b$[ebp] push ecx mov edx, DWORD PTR _a$[ebp] push edx call?sum@@yahhh@z ; sum add esp, 8 mov DWORD PTR _c$[ebp], eax ESP n+4 b n a n-4 return addr n-8 n Seong Jong Choi Assembly Language-32

33 Function Call - Caller ; 14 : c = sum(a,b); eax 에저장된계산결과를 c 로저장 return addr: mov ecx, DWORD PTR _b$[ebp] push ecx mov edx, DWORD PTR _a$[ebp] push edx call?sum@@yahhh@z ; sum add esp, 8 mov DWORD PTR _c$[ebp], eax ESP n+4 b n a n-4 return addr n-8 n Seong Jong Choi Assembly Language-33

34 Function Call: Summary 스택공간의용도 매개변수를위한공간으로사용. 오른쪽매개변수부터스택에 push 된다. 함수내의지역변수를위한공간으로사용 ebp 의용도 함수내에서의모든매개변수와지역변수는 ebp 와인덱스를사용하여접근한다. ebp 는함수내지역변수를위한 stack 공간의맨위를가리킨다. 함수시작전스택에 push 하고종료후 pop 하는레지스터 ebp, edi, esi, ebx int 형반환데이터는 eax 에저장된다. 함수호출측은함수종료후, 매개변수를위해사용한스택공간을재조정한다. (add esp, 8) Seong Jong Choi Assembly Language-34

35 Return Instruction sum() 과 wsum() 함수의차이는함수종료후누가 ( 호출측 or 함수측 ) 매개변수를위한스택공간을정리하는가이다. sum() return instruction: ret 0 wsum() return instruction: ret 8 ret n RET transfers control to a return address located on the stack. The address is usually placed on the stack by a CALL instruction, and the return is made to the instruction that follows the CALL. The optional numeric parameter to RET gives the number of stack bytes to be released after the return address is popped. These items are typically used as input parameters to the procedure called Seong Jong Choi Assembly Language-35

36 Calling Convention Keyword Stack cleanup Parameter passing cdecl (C default) Caller Pushes parameters on the stack, in reverse order (right to left) stdcall (#define WINAPI stdcall) Callee Pushes parameters on the stack, in reverse order (right to left) fastcall Callee Stored in registers, then pushed on stack thiscall (not a keyword) Callee Pushed on stack; this pointer stored in ECX Seong Jong Choi Assembly Language-36

hlogin2

hlogin2 0x02. Stack Corruption off-limit Kernel Stack libc Heap BSS Data Code off-limit Kernel Kernel : OS Stack libc Heap BSS Data Code Stack : libc : Heap : BSS, Data : bss Code : off-limit Kernel Kernel : OS