예제 #1
0
파일: overflow.c 프로젝트: xuyuanxin/notes
void dump_stack()
{
    int a = 0xaabbccdd;
	int i = 0;
	int *beg;

	beg = &a+128;
	printf("stack--> esp:0x%x ebp:0x%x &a:0x%x:%d &i:0x%x:%d &beg:0x%x 0x%x\n",
		   get_esp(),get_ebp(),&a,a,&i,i,&beg,beg);
	
	for(i = 0; i < 128+64; i+=4)
	{
	    printf("0x%x: %08x %08x %08x %08x\n",(int)(beg-i),
			   *(beg-i),*(beg-i-1),*(beg-i-2),*(beg-i-3));
	}
	
	printf("stack--> esp:0x%x ebp:0x%x &a:0x%x:%d &i:0x%x:%d\n",get_esp(),get_ebp(),&a,a,&i,i);
}
예제 #2
0
파일: overflow.c 프로젝트: xuyuanxin/notes
void active (int idx,int value)
{   
    int flag=0x33333333;
    int a = 0x44444444;
	
	printf("active--> esp1:0x%x ebp1:0x%x &flag:0x%x\n",get_esp(),get_ebp(),&flag);
	dump_stack();
    //fflush();
	*(&a+idx) = value;
}
예제 #3
0
파일: overflow.c 프로젝트: xuyuanxin/notes
int main(int argc,char *argv[]) 
{
    int flag1=0x11111111;
    int idx,value;
	int flag2=0x22222222;

	printf("main--> esp1:0x%x ebp1:0x%x &flag1:0x%x &flag2:0x%x\n",
		   get_esp(),get_ebp(),&flag1,&flag2);
	
	if(argc != 3){
		printf("Usage: %s idx value\n",argv[0]);
		return -1;
	}

	idx = atoi(argv[1]);
	value = atoi(argv[2]);
	printf("main--> idx:%d value:0x%x\n",idx,value);	
	printf("main--> esp2:0x%x ebp2:0x%x\n",get_esp(),get_ebp());
    active(idx,value); 
    return 0; 
}
예제 #4
0
파일: asm.c 프로젝트: cheuk-fung/C--
static void get_pos(struct Syntree_node *sn, int dir)
{
#ifdef NGDEBUG
    assert(sn->nkind == K_EXPR);
#endif
    switch (sn->se.expr) {
        case K_CHAR:
            sprintf(postmp, "$%d", sn->info.c);
            break;
        case K_STR:
            sprintf(postmp, "$.str%d", sn->info.strno);
            break;
        case K_INT:
            sprintf(postmp, "$%d", sn->info.val);
            break;
        case K_DOUBLE:
            sprintf(postmp, ".dbl%d", sn->info.dblno);
            break;
            /* TODO */
        case K_SYM:
            {
                int offset = sn->info.symbol->offset;
                if (offset == -1) {
                    sprintf(eptmp, "%s", sn->info.symbol->name);
                } else if (offset < curr_func_env->param_size) {
                    get_ebp(offset);
                } else {
                    get_esp(offset + curr_func_env->tmp_size + curr_func_env->call_size - curr_func_env->param_size);
                }
                if (dir == TO || sn->ntype.kind == T_DOUBLE) {
                    sprintf(postmp, "%s", eptmp);
                } else {
                    fprintf(fasm, "\t%s\t%s, %s\n", mov_action(sn->ntype.kind), eptmp, type_register(sn->ntype.kind));
                    sprintf(postmp, "%s", type_register(sn->ntype.kind));
                }
                break;
            }
        case K_PTR:
            {
                int ptrcnt = 0;
                struct Syntree_node *tmp;
                for (tmp = sn; tmp->se.expr == K_PTR; tmp = tmp->child[0]) {
                    ptrcnt++;
                }
                get_pos(tmp, TO);
                if (tmp->nkind == K_EXPR && tmp->se.expr == K_SYM && tmp->info.symbol->offset == -1) {
                    fprintf(fasm, "\tleal\t%s, %%edx\n", postmp);
                } else {
                    fprintf(fasm, "\tmovl\t%s, %%edx\n", postmp);
                }
                int i;
                for (i = 1; i < ptrcnt; i++) {
                    fprintf(fasm, "\tmovl\t(%%edx), %%edx\n");
                }
                if (dir == TO) {
                    sprintf(postmp, "(%%edx)");
                } else {
                    fprintf(fasm, "\tmovl\t(%%edx), %%edx\n");
                    sprintf(postmp, "%%edx");
                }
                break;
            }
        case K_ARY:
            {
                int arycnt = 0, arysize[16];
                struct Arysize_entry *ae;
                for (ae = sn->info.symbol->arysize_list; ae; ae = ae->next) {
                    arysize[arycnt++] = ae->size;
                }

                int aryoffset = 1;
                struct Syntree_node *tmp;
                fprintf(fasm, "\tsarl\t$31, %%edx\n");
                for (tmp = sn; tmp->se.expr != K_SYM; tmp = tmp->child[0]) {
                    asm_translate(tmp->child[1]);
                    get_pos(tmp->child[1], TO);
                    if (aryoffset != 1) {
                        fprintf(fasm, "\tmovl\t%s, %%eax\n", postmp);
                        fprintf(fasm, "\timull\t$%d, %%eax\n", aryoffset);
                        fprintf(fasm, "\taddl\t%%eax, %%edx\n");
                    } else {
                        fprintf(fasm, "\taddl\t%s, %%edx\n", postmp);
                    }
                    aryoffset = arysize[--arycnt];
                }

                int offset = sn->info.symbol->offset;
                if (offset == -1) {
                    sprintf(eptmp, "%s(,%%edx,%zd)", sn->info.symbol->name, sn->info.symbol->size);
                } else if (offset < curr_func_env->param_size) {
                    sprintf(eptmp, "-%zd(%%ebp,%%edx,%zd)", offset + 8, sn->info.symbol->size);
                } else {
                    sprintf(eptmp, "%zd(%%esp,%%edx,%zd)", offset + curr_func_env->tmp_size + curr_func_env->call_size - curr_func_env->param_size, sn->info.symbol->size);
                }

                if (dir == TO || sn->ntype.kind == T_DOUBLE) {
                    sprintf(postmp, "%s", eptmp);
                } else {
                    fprintf(fasm, "\t%s\t%s, %s\n", mov_action(sn->ntype.kind), eptmp, type_register(sn->ntype.kind));
                    sprintf(postmp, "%s", type_register(sn->ntype.kind));
                }
                break;
            }
        case K_DOT:
            {
                int offset = sn->child[0]->info.symbol->offset;
                if (offset == -1) {
                    sprintf(eptmp, "%s+%zd", sn->child[0]->info.symbol->name, sn->child[1]->info.symbol->offset);
                } else if (offset < curr_func_env->param_size) {
                    get_ebp(offset + sn->child[1]->info.symbol->offset);
                } else {
                    get_esp(offset + curr_func_env->tmp_size + curr_func_env->call_size - curr_func_env->param_size + sn->child[1]->info.symbol->offset);
                }
                if (dir == TO || sn->ntype.kind == T_DOUBLE) {
                    sprintf(postmp, "%s", eptmp);
                } else {
                    fprintf(fasm, "\t%s\t%s, %s\n", mov_action(sn->ntype.kind), eptmp, type_register(sn->ntype.kind));
                    sprintf(postmp, "%s", type_register(sn->ntype.kind));
                }
                break;
            }
        case K_CALL:
        case K_OPR:
            {
                get_esp(sn->tmppos);
                if (dir == TO || sn->ntype.kind == T_DOUBLE) {
                    sprintf(postmp, "%s", eptmp);
                } else if (sn->ntype.kind != T_DOUBLE) {
                    fprintf(fasm, "\t%s\t%s, %s\n", mov_action(sn->ntype.kind), eptmp, type_register(sn->ntype.kind));
                    sprintf(postmp, "%s", type_register(sn->ntype.kind));
                }
            }
            break;
    }
}
예제 #5
0
// Formatted Printing
int myprintf(char *fmt, ...)
{
    //                12    8      4      0
    // ... d | c | b | a | fmt | retPC | ebp | locals ...

    int *ebp = (int*)get_ebp();
    char *cp = fmt;

    // each int ptr increment = 4 bytes 
    // 12 / 4 = 3
    int *ip = ebp + 3;

    while(*cp)
    {
        if (*cp != '%')
        {
            // for each \n, spit out an extra \r
            if (putchar(*cp) == '\n')
                putchar('\r'); 
        }
        else
        {
            cp++; // bypass %
            switch (*cp) // *cp = char after %
            {

                case 'c': // char
                    putchar(*ip);
                    ip++;
                    break;

                case 's': // string
                    prints((char*)(*ip));
                    ip++;	      
                    break;

                case 'd': // int
                    printd(*ip);
                    ip++;
                    break;

                case 'o': // OCTAL 
                    printo(*ip);
                    ip++;
                    break;

                case 'x': // HEX
                    printx(*ip);
                    ip++;
                    break;

                case 'u': // unsigned int
                    printu(*ip);
                    ip++;
                    break;

                case '%': // %% -> %
                    putchar('%');
                    break;

                default: // unknown specifier
                    putchar('%');
                    putchar(*cp);
                    break;

            }// switch(*cp)

        }// if(%)

        cp++;

    } // while(cp)

} // myprintf()