[Popular material](https://qiita.com/search?q=%E3%82%BB%E3%82%B0%E3%83%95%E3%82%A9%E3%82%89%E3 It is a piggyback ride on% 81% 9B% E3% 82% 8B).
I am using x86-64 Ubuntu 19.04 + gcc 8.3.0 as the operation check environment.
Build and run
$ gcc -xc /dev/null -nostdlib -Wl,-e0xfa -Wl,-Ttext=0x2504890000 -zexecstack && ./a.out
Segmentation fault (core dumped)
$
First, compile and compile the smallest C program that does not give a warning.
int main(){}
Since it is troublesome to prepare the source code, I will use the echo command to connect with the compiler with | and input it directly as the standard input. Since the compiler cannot determine the type of the input file by the extension of the input file, use the command line option `-xc'notifying that it is a C source.
$ echo 'int main(){}' | gcc -xc - && ls -l a.out
-rwxr-xr-x 1 fujita fujita 16344 Jul 8 22:31 a.out
$
An executable file of about 16kB has been created. When I feed the generated a.out to the readelf command
$ readelf -S a.out
There are 28 section headers, starting at offset 0x38d8:
Section Headers:
[Nr] Name Type Address Offset
Size EntSize Flags Link Info Align
[ 0] NULL 0000000000000000 00000000
0000000000000000 0000000000000000 0 0 0
[ 1] .interp PROGBITS 00000000000002a8 000002a8
000000000000001c 0000000000000000 A 0 0 1
[ 2] .note.gnu.build-i NOTE 00000000000002c4 000002c4
0000000000000024 0000000000000000 A 0 0 4
[ 3] .note.ABI-tag NOTE 00000000000002e8 000002e8
0000000000000020 0000000000000000 A 0 0 4
[ 4] .gnu.hash GNU_HASH 0000000000000308 00000308
0000000000000024 0000000000000000 A 5 0 8
[ 5] .dynsym DYNSYM 0000000000000330 00000330
0000000000000090 0000000000000018 A 6 1 8
[ 6] .dynstr STRTAB 00000000000003c0 000003c0
000000000000007d 0000000000000000 A 0 0 1
[ 7] .gnu.version VERSYM 000000000000043e 0000043e
000000000000000c 0000000000000002 A 5 0 2
[ 8] .gnu.version_r VERNEED 0000000000000450 00000450
0000000000000020 0000000000000000 A 6 1 8
[ 9] .rela.dyn RELA 0000000000000470 00000470
00000000000000c0 0000000000000018 A 5 0 8
[10] .init PROGBITS 0000000000001000 00001000
0000000000000017 0000000000000000 AX 0 0 4
[11] .plt PROGBITS 0000000000001020 00001020
0000000000000010 0000000000000010 AX 0 0 16
[12] .plt.got PROGBITS 0000000000001030 00001030
0000000000000008 0000000000000008 AX 0 0 8
[13] .text PROGBITS 0000000000001040 00001040
0000000000000151 0000000000000000 AX 0 0 16
[14] .fini PROGBITS 0000000000001194 00001194
0000000000000009 0000000000000000 AX 0 0 4
[15] .rodata PROGBITS 0000000000002000 00002000
0000000000000004 0000000000000004 AM 0 0 4
[16] .eh_frame_hdr PROGBITS 0000000000002004 00002004
000000000000003c 0000000000000000 A 0 0 4
[17] .eh_frame PROGBITS 0000000000002040 00002040
0000000000000108 0000000000000000 A 0 0 8
[18] .init_array INIT_ARRAY 0000000000003df0 00002df0
0000000000000008 0000000000000008 WA 0 0 8
[19] .fini_array FINI_ARRAY 0000000000003df8 00002df8
0000000000000008 0000000000000008 WA 0 0 8
[20] .dynamic DYNAMIC 0000000000003e00 00002e00
00000000000001c0 0000000000000010 WA 6 0 8
[21] .got PROGBITS 0000000000003fc0 00002fc0
0000000000000040 0000000000000008 WA 0 0 8
[22] .data PROGBITS 0000000000004000 00003000
0000000000000010 0000000000000000 WA 0 0 8
[23] .bss NOBITS 0000000000004010 00003010
0000000000000008 0000000000000000 WA 0 0 1
[24] .comment PROGBITS 0000000000000000 00003010
0000000000000023 0000000000000001 MS 0 0 1
[25] .symtab SYMTAB 0000000000000000 00003038
00000000000005b8 0000000000000018 26 43 8
[26] .strtab STRTAB 0000000000000000 000035f0
00000000000001e9 0000000000000000 0 0 1
[27] .shstrtab STRTAB 0000000000000000 000037d9
00000000000000f9 0000000000000000 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
L (link order), O (extra OS processing required), G (group), T (TLS),
C (compressed), x (unknown), o (OS specific), E (exclude),
l (large), p (processor specific)
$
You can see that it contains many sections.
Then try compiling the 0-character source. Use / dev / null instead of the source file, which always returns an EOF when read. You don't even need a startup to call main, so specify the \ -nostdlib'option. If you use this, the default program execution start address _start will not be found and the linker will warn you, so use the -Wl, -e0'option to specify 0 as the temporary execution start address.
$ gcc -xc /dev/null -nostdlib -Wl,-e0 && ls -l a.out
-rwxr-xr-x 1 fujita fujita 9512 Jul 8 22:35 a.out
$
An executable file of about 9.5kB has been created. If you feed this to the readelf command
$ readelf -S a.out
There are 12 section headers, starting at offset 0x2228:
Section Headers:
[Nr] Name Type Address Offset
Size EntSize Flags Link Info Align
[ 0] NULL 0000000000000000 00000000
0000000000000000 0000000000000000 0 0 0
[ 1] .interp PROGBITS 0000000000000200 00000200
000000000000001c 0000000000000000 A 0 0 1
[ 2] .note.gnu.build-i NOTE 000000000000021c 0000021c
0000000000000024 0000000000000000 A 0 0 4
[ 3] .gnu.hash GNU_HASH 0000000000000240 00000240
000000000000001c 0000000000000000 A 4 0 8
[ 4] .dynsym DYNSYM 0000000000000260 00000260
0000000000000018 0000000000000018 A 5 1 8
[ 5] .dynstr STRTAB 0000000000000278 00000278
0000000000000001 0000000000000000 A 0 0 1
[ 6] .eh_frame PROGBITS 0000000000001000 00001000
0000000000000000 0000000000000000 A 0 0 8
[ 7] .dynamic DYNAMIC 0000000000001f20 00001f20
00000000000000e0 0000000000000010 WA 5 0 8
[ 8] .comment PROGBITS 0000000000000000 00002000
0000000000000023 0000000000000001 MS 0 0 1
[ 9] .symtab SYMTAB 0000000000000000 00002028
0000000000000168 0000000000000018 10 12 8
[10] .strtab STRTAB 0000000000000000 00002190
0000000000000027 0000000000000000 0 0 1
[11] .shstrtab STRTAB 0000000000000000 000021b7
000000000000006c 0000000000000000 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
L (link order), O (extra OS processing required), G (group), T (TLS),
C (compressed), x (unknown), o (OS specific), E (exclude),
l (large), p (processor specific)
$
You can see that the executable still contains multiple sections, though less than the smallest main example.
Some command line options to the linker specify the starting address of the section. Try specifying the value 0x123456789abcdef0 as the starting address for the .text section that is not included in the list of sections above. The following command line option `-Wl, -Ttext = 0x123456789abcdef0'is applicable.
$ gcc -xc /dev/null -nostdlib -Wl,-e0 -Wl,-Ttext=0x123456789abcdef0 && ls -l a.out
-rwxr-xr-x 1 fujita fujita 9512 Jul 8 22:41 a.out
$ readelf -S a.out
There are 12 section headers, starting at offset 0x2228:
Section Headers:
[Nr] Name Type Address Offset
Size EntSize Flags Link Info Align
[ 0] NULL 0000000000000000 00000000
0000000000000000 0000000000000000 0 0 0
[ 1] .interp PROGBITS 0000000000000238 00000238
000000000000001c 0000000000000000 A 0 0 1
[ 2] .note.gnu.build-i NOTE 0000000000000254 00000254
0000000000000024 0000000000000000 A 0 0 4
[ 3] .gnu.hash GNU_HASH 0000000000000278 00000278
000000000000001c 0000000000000000 A 4 0 8
[ 4] .dynsym DYNSYM 0000000000000298 00000298
0000000000000018 0000000000000018 A 5 1 8
[ 5] .dynstr STRTAB 00000000000002b0 000002b0
0000000000000001 0000000000000000 A 0 0 1
[ 6] .eh_frame PROGBITS 123456789abce000 00001000
0000000000000000 0000000000000000 A 0 0 8
[ 7] .dynamic DYNAMIC 123456789abcef20 00001f20
00000000000000e0 0000000000000010 WA 5 0 8
[ 8] .comment PROGBITS 0000000000000000 00002000
0000000000000023 0000000000000001 MS 0 0 1
[ 9] .symtab SYMTAB 0000000000000000 00002028
0000000000000168 0000000000000018 10 12 8
[10] .strtab STRTAB 0000000000000000 00002190
0000000000000027 0000000000000000 0 0 1
[11] .shstrtab STRTAB 0000000000000000 000021b7
000000000000006c 0000000000000000 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
L (link order), O (extra OS processing required), G (group), T (TLS),
C (compressed), x (unknown), o (OS specific), E (exclude),
l (large), p (processor specific)
$
I don't know what the section is, but you can see that the section .eh_frame is affected and has a similar address. It seems that the lower 16 bits of the address, which is the value of the Offset item, are aligned from def0 to ʻe000`.
These section information should be in the executable a.out. Try a hexadecimal dump with the hexdump command
$ hexdump -C a.out | head -24
00000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............|
00000010 03 00 3e 00 01 00 00 00 00 00 00 00 00 00 00 00 |..>.............|
00000020 40 00 00 00 00 00 00 00 28 22 00 00 00 00 00 00 |@.......("......|
00000030 00 00 00 00 40 00 38 00 09 00 40 00 0c 00 0b 00 |[email protected]...@.....|
00000040 06 00 00 00 04 00 00 00 40 00 00 00 00 00 00 00 |........@.......|
00000050 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 |@.......@.......|
00000060 f8 01 00 00 00 00 00 00 f8 01 00 00 00 00 00 00 |................|
00000070 08 00 00 00 00 00 00 00 03 00 00 00 04 00 00 00 |................|
00000080 38 02 00 00 00 00 00 00 38 02 00 00 00 00 00 00 |8.......8.......|
00000090 38 02 00 00 00 00 00 00 1c 00 00 00 00 00 00 00 |8...............|
000000a0 1c 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 |................|
000000b0 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 |................|
000000c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000000d0 b1 02 00 00 00 00 00 00 b1 02 00 00 00 00 00 00 |................|
000000e0 00 10 00 00 00 00 00 00 01 00 00 00 04 00 00 00 |................|
000000f0 00 10 00 00 00 00 00 00 00 e0 bc 9a 78 56 34 12 |............xV4.|
00000100 00 e0 bc 9a 78 56 34 12 00 00 00 00 00 00 00 00 |....xV4.........|
00000110 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 |................|
00000120 01 00 00 00 06 00 00 00 20 1f 00 00 00 00 00 00 |........ .......|
00000130 20 ef bc 9a 78 56 34 12 20 ef bc 9a 78 56 34 12 | ...xV4. ...xV4.|
00000140 e0 00 00 00 00 00 00 00 e0 00 00 00 00 00 00 00 |................|
00000150 00 10 00 00 00 00 00 00 02 00 00 00 06 00 00 00 |................|
00000160 20 1f 00 00 00 00 00 00 20 ef bc 9a 78 56 34 12 | ....... ...xV4.|
00000170 20 ef bc 9a 78 56 34 12 e0 00 00 00 00 00 00 00 | ...xV4.........|
$
You can see that 8 bytes from address 000000f8, which seems to be the start address of .eh_frame, is stored in little endian.
By using \ -Wl, -Ttext = 0xXXXXXXXXXXXX0000', assuming that the lower 16 bits are ignored to avoid alignment of addresses, any byte string from address 000000fa is embedded in the executable file as the address of .eh_frame. I think I can do it. As a test, specify \ -Wl, -Ttext = 0x2504890000'and place 89 04 25 from address 000000fa. Specify the address 000000fa as the execution address with \ -e0xfa', and also specify \ -zexecstack', which enables execution in areas other than the code area.
$ gcc -xc /dev/null -nostdlib -Wl,-e0xfa -Wl,-Ttext=0x2504890000 -zexecstack && ls -l a.out
-rwxr-xr-x 1 fujita fujita 9512 Jul 8 22:49 a.out
$ ./a.out
Segmentation fault (core dumped)
$
I was able to confirm that segfault occurs by executing the generated a.out. Let's use the objdump command to see the instructions embedded in the executable file from address 000000fa.
$ objdump -D -bbinary -mi386 -Mintel,x86-64 --start-address=0xfa a.out | head -8
a.out: file format binary
Disassembly of section .data:
000000fa <.data+0xfa>:
fa: 89 04 25 00 00 00 00 mov DWORD PTR ds:0x0,eax
$
The content is to write the value of the EAX register to address 0. By trying to do this, you can see that the OS protection feature segfaulted.
With the above, we have achieved the title "Segfault with 0 characters with gcc". In addition, it is possible to issue an error other than segfault by devising the contents of \ `-Wl, -Ttext = 0xXXXXXXXXXXXX0000'.
Call software interrupt INT3 for debugging
$ gcc -xc /dev/null -nostdlib -Wl,-e0xfa -Wl,-Ttext=0xcc0000 -zexecstack && ls -l a.out
-rwxr-xr-x 1 fujita fujita 9512 Jul 8 22:55 a.out
$ objdump -D -bbinary -mi386 -Mintel,x86-64 --start-address=0xfa a.out | head -8
a.out: file format binary
Disassembly of section .data:
000000fa <.data+0xfa>:
fa: cc int3
$ ./a.out
Trace/breakpoint trap (core dumped)
$
Execute UD2 reserved as an illegal instruction
$ gcc -xc /dev/null -nostdlib -Wl,-e0xfa -Wl,-Ttext=0x0b0f0000 -zexecstack && ls -l a.out
-rwxr-xr-x 1 fujita fujita 9512 Jul 8 22:56 a.out
$ objdump -D -bbinary -mi386 -Mintel,x86-64 --start-address=0xfa a.out | head -8
a.out: file format binary
Disassembly of section .data:
000000fa <.data+0xfa>:
fa: 0f 0b ud2
$ ./a.out
Illegal instruction (core dumped)
$
Divide the value of the AX register by the contents of address 0x100 where 0 is stored to generate a division by zero error.
$ gcc -xc /dev/null -nostdlib -Wl,-e0xfa -Wl,-Ttext=0x35f60000 -zexecstack && ls -l a.out
-rwxr-xr-x 1 fujita fujita 9512 Jul 8 22:58 a.out
$ objdump -D -bbinary -mi386 -Mintel,x86-64 --start-address=0xfa a.out | head -9
a.out: file format binary
Disassembly of section .data:
000000fa <.data+0xfa>:
fa: f6 35 00 00 00 00 div BYTE PTR [rip+0x0] # 0x100
100: 00 00 add BYTE PTR [rax],al
$ ./a.out
Floating point exception (core dumped)
$
It's fun to try various things.
The end.
Recommended Posts