lecture 03 control flow
play

Lecture 03 Control Flow Stephen Checkoway University of Illinois - PowerPoint PPT Presentation

Jan 20, 2024 •301 likes •837 views

Lecture 03 Control Flow Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Adapted from Michael Baileys ECE 422 Outline Computer CPU Instructions The Stack (x86) What is a stack How it is

  1. Lecture 03 – Control Flow Stephen Checkoway University of Illinois at Chicago CS 487 – Fall 2017 Adapted from Michael Bailey’s ECE 422

  2. Outline • Computer – CPU – Instructions • The Stack (x86) – What is a stack – How it is used by programs – Technical details • Attacks • Buffer overflows • Adapted from Aleph One’s “Smashing the Stack for Fun and Profit”

  3. “Insecurity”? Level-2 Problem: “Weakness” Factors that predispose systems to vulnerability Level-1 Problem: “Vulnerability” “Attack” Specific errors that could be exploited in an assault. exploit, vulnerabilities Level-0 Problem: “Exploit” are ingredients Actual malicious attempt to cause harm.

  4. Why Study Attacks? • Identify vulnerabilities so they can be fixed. • Create incentives for vendors to be careful. • Learn about new classes of threats. – Determine what we need to defend against. – Help designers build stronger systems. – Help users more accurately evaluate risk.

  5. static OSStatus SSLVerifySignedServerKeyExchange(SSLContext *ctx, bool isRsa, SSLBuffer signedParams, uint8_t *signature, UInt16 signatureLen) { OSStatus err; ... if ((err = SSLHashSHA1.update(&hashCtx, &serverRandom)) != 0) goto fail; if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0) goto fail; goto fail; if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0) goto fail; ... fail: SSLFreeBuffer(&signedHashes); SSLFreeBuffer(&hashCtx); return err; }

  6. example.c void foo(int a, int b) { char buf1[10]; } void main() { foo(3,6); }

  7. C stack frames } main SP Local variables FP

  8. C stack frames SP } main function args Local variables FP

  9. C stack frames SP return address } main function args Local variables FP

  10. C stack frames } foo SP main’s FP return address } main function args Local variables FP

  11. C stack frames } foo SP FP main’s FP return address } main function args Local variables

  12. C stack frames } foo SP Local variables FP main’s FP return address } main function args Local variables

  13. C stack frames (x86 specific) Grows toward lower address Low address 0x00 Starts ~end of VA space Two related registers %ESP - Stack Pointer %EBP - Frame Pointer High address 0xff

  14. example.c void foo(int a, int b) { char buf1[16]; } int main() { foo(3,6); }

  15. example.s (x86) main: pushl %ebp movl %esp, %ebp subl $8, %esp movl $6, 4(%esp) movl $3, (%esp) call foo leave prev FP ret

  16. example.s (x86) main: pushl %ebp movl %esp, %ebp subl $8, %esp movl $6, 4(%esp) movl $3, (%esp) call foo leave prev FP ret

  17. example.s (x86) main: pushl %ebp movl %esp, %ebp subl $8, %esp movl $6, 4(%esp) movl $3, (%esp) call foo leave prev FP ret

  18. example.s (x86) main: pushl %ebp movl %esp, %ebp subl $8, %esp movl $6, 4(%esp) movl $3, (%esp) call foo 6 leave prev FP ret

  19. example.s (x86) main: pushl %ebp movl %esp, %ebp subl $8, %esp movl $6, 4(%esp) movl $3, (%esp) 3 call foo 6 leave prev FP ret

  20. example.s (x86) main: pushl %ebp movl %esp, %ebp subl $8, %esp movl $6, 4(%esp) return movl $3, (%esp) 3 call foo 6 leave prev FP ret

  21. example.s (x86) foo: pushl %ebp movl %esp, %ebp main FP subl $16, %esp return leave 3 ret 6 prev FP

  22. example.s (x86) foo: pushl %ebp movl %esp, %ebp main FP subl $16, %esp return leave 3 ret 6 prev FP

  23. example.s (x86) foo: … pushl %ebp movl %esp, %ebp main FP subl $16, %esp return leave 3 ret 6 prev FP

  24. example.s (x86) foo: … pushl %ebp movl %esp, %ebp main FP subl $16, %esp return leave 3 ret 6 mov %ebp, %esp prev FP pop %ebp

  25. example.s (x86) foo: … pushl %ebp movl %esp, %ebp main FP subl $16, %esp return leave 3 ret 6 mov %ebp, %esp prev FP pop %ebp

  26. example.s (x86) foo: … pushl %ebp movl %esp, %ebp subl $16, %esp return leave 3 ret 6 mov %ebp, %esp prev FP pop %ebp

  27. example.s (x86) foo: … pushl %ebp movl %esp, %ebp subl $16, %esp return leave 3 ret 6 mov %ebp, %esp prev FP pop %ebp

  28. example.s (x86) main: … pushl %ebp movl %esp, %ebp subl $8, %esp movl $6, 4(%esp) movl $3, (%esp) 3 call foo 6 leave prev FP mov %ebp, %esp ret pop %ebp

  29. example.s (x86) main: … pushl %ebp movl %esp, %ebp subl $8, %esp movl $6, 4(%esp) movl $3, (%esp) call foo leave prev FP mov %ebp, %esp ret pop %ebp

  30. example.s (x86) main: … pushl %ebp movl %esp, %ebp subl $8, %esp movl $6, 4(%esp) movl $3, (%esp) call foo leave mov %ebp, %esp ret pop %ebp

  31. Buffer overflow example void foo(char *str) { char buffer[16]; strcpy(buffer, str); } int main() { char buf[256]; memset(buf, ‘A’, 255); buf[255] = ‘\x00’; foo(buf); }

  32. Buffer overflow example void foo(char *str) { char buffer[16]; strcpy(buffer, str); } int main() { char buf[256]; memset(buf, ‘A’, 255); buf[255] = ‘\x00’; foo(buf); }

  33. Buffer overflow example void foo(char *str) { char buffer[16]; strcpy(buffer, str); } int main() { char buf[256]; memset(buf, ‘A’, 255); AAAAAAA… buf[255] = ‘\x00’; foo(buf); prev FP }

  34. Buffer overflow example void foo(char *str) { char buffer[16]; strcpy(buffer, str); } int main() { foo_arg1 char buf[256]; memset(buf, ‘A’, 255); AAAAAAA… buf[255] = ‘\x00’; foo(buf); prev FP }

  35. Buffer overflow example void foo(char *str) { char buffer[16]; strcpy(buffer, str); } return int main() { foo_arg1 char buf[256]; memset(buf, ‘A’, 255); AAAAAAA… buf[255] = ‘\x00’; foo(buf); prev FP }

  36. Buffer overflow example void foo(char *str) { char buffer[16]; strcpy(buffer, str); main FP } return int main() { foo_arg1 char buf[256]; memset(buf, ‘A’, 255); AAAAAAA… buf[255] = ‘\x00’; foo(buf); prev FP }

  37. Buffer overflow example void foo(char *str) { char buffer[16]; strcpy(buffer, str); main FP } return int main() { foo_arg1 char buf[256]; memset(buf, ‘A’, 255); AAAAAAA… buf[255] = ‘\x00’; foo(buf); prev FP }

  38. Buffer overflow example void foo(char *str) { AAAAAAA… char buffer[16]; strcpy(buffer, str); 0x41414141 } 0x41414141 int main() { 0x41414141 char buf[256]; memset(buf, ‘A’, 255); AAAAAAA… buf[255] = ‘\x00’; foo(buf); prev FP }

  39. Buffer overflow example void foo(char *str) { AAAAAAA… char buffer[16]; strcpy(buffer, str); 0x41414141 mov %ebp, %esp } pop %ebp 0x41414141 ret int main() { 0x41414141 char buf[256]; memset(buf, ‘A’, 255); AAAAAAA… buf[255] = ‘\x00’; foo(buf); prev FP }

  40. Buffer overflow example void foo(char *str) { AAAAAA… char buffer[16]; strcpy(buffer, str); 0x41414141 mov %ebp, %esp } pop %ebp 0x41414141 ret int main() { 0x41414141 char buf[256]; memset(buf, ‘A’, 255); AAAAAAA… buf[255] = ‘\x00’; foo(buf); prev FP }

  41. Buffer overflow example void foo(char *str) { AAAAAA… char buffer[16]; strcpy(buffer, str); 0x41414141 mov %ebp, %esp } pop %ebp 0x41414141 ret int main() { 0x41414141 char buf[256]; memset(buf, ‘A’, 255); AAAAAAA… buf[255] = ‘\x00’; foo(buf); ? prev FP }

  42. Buffer overflow example void foo(char *str) { AAAAAA… char buffer[16]; strcpy(buffer, str); 0x41414141 mov %ebp, %esp } pop %ebp 0x41414141 ret int main() { 0x41414141 char buf[256]; memset(buf, ‘A’, 255); AAAAAAA… buf[255] = ‘\x00’; foo(buf); ? prev FP }

  43. Buffer overflow example %eip = 0x41414141 AAAAAA… 0x41414141 ??? 0x41414141 0x41414141 AAAAAAA… ? prev FP

  44. Buffer overflow FTW • Success! Program crashed! • Can we do better? – Yes • How?

  45. Exploiting buffer overflows void foo(char *str) { char buffer[16]; strcpy(buffer, str); } int main() { char buf[256]; memset(buf, ‘A’, 255); buf[255] = ‘\x00’; ((int*)buf)[5] = (int)buf; foo(buf); }

  46. Exploiting buffer overflows void foo(char *str) { AAAAAAA… char buffer[16]; strcpy(buffer, str); 0x41414141 } buf int main() { 0x41414141 char buf[256]; memset(buf, ‘A’, 255); AAAAAAA… buf[255] = ‘\x00’; ((int*)buf)[5] = (int)buf; prev FP foo(buf); }

  47. Exploiting buffer overflows void foo(char *str) { AAAAAAA… char buffer[16]; strcpy(buffer, str); 0x41414141 mov %ebp, %esp } pop %ebp buf ret int main() { 0x41414141 char buf[256]; memset(buf, ‘A’, 255); AAAAAAA… buf[255] = ‘\x00’; ((int*)buf)[5] = (int)buf; prev FP foo(buf); }

  48. Exploiting buffer overflows void foo(char *str) { AAAAAAA… char buffer[16]; strcpy(buffer, str); 0x41414141 mov %ebp, %esp } pop %ebp buf ret int main() { 0x41414141 char buf[256]; memset(buf, ‘A’, 255); AAAAAAA… buf[255] = ‘\x00’; ((int*)buf)[5] = (int)buf; prev FP foo(buf); }

  49. Exploiting buffer overflows void foo(char *str) { AAAAAAA… char buffer[16]; strcpy(buffer, str); 0x41414141 mov %ebp, %esp } pop %ebp buf ret int main() { 0x41414141 char buf[256]; memset(buf, ‘A’, 255); AAAAAAA… buf[255] = ‘\x00’; ((int*)buf)[5] = (int)buf; prev FP foo(buf); }

Recommend

1 Why Why flow flow control? control? sender

1 Why Why flow flow control? control? sender

Lecture 7. Lecture 7. TCP mechanisms for: TCP mechanisms for: data transfer control / flow control error control congestion control Graphical examples (applet java) of several algorithms at:

589 views • 13 slides
Control Structures Lecture 4 COP 3014 Fall 2020 September 10, 2020 Control Flow Control flow

Control Structures Lecture 4 COP 3014 Fall 2020 September 10, 2020 Control Flow Control flow

Control Structures Lecture 4 COP 3014 Fall 2020 September 10, 2020 Control Flow Control flow refers to the specification of the order in which the individual statements, instructions or function calls of an imperative program are executed or

333 views • 19 slides
Lecture 6: Flow Control Lecture 6: Flow Control 1 / 28 Relational Expressions Conditions in if

Lecture 6: Flow Control Lecture 6: Flow Control 1 / 28 Relational Expressions Conditions in if

Lecture 6: Flow Control Lecture 6: Flow Control 1 / 28 Relational Expressions Conditions in if statements use expressions that are conceptually either true or false . These expressions are called relational expressions or Boolean expressions

570 views • 28 slides
Lecture 08 Control-flow Hijacking Defenses Stephen Checkoway University of Illinois at

Lecture 08 Control-flow Hijacking Defenses Stephen Checkoway University of Illinois at

Lecture 08 Control-flow Hijacking Defenses Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides adapted from Miller, Bailey, and Brumley Control Flow Hijack: Always control + computation shellcode (aka payload)

652 views • 36 slides
1 What Is Control-Flow Analysis? Loop Concepts Control-flow analysis discovers the flow of

1 What Is Control-Flow Analysis? Loop Concepts Control-flow analysis discovers the flow of

Control-Flow Analysis and Loop Detection Context Last time Data-flow Speeding up data-flow analysis Flow of data values from defs to uses Could alternatively be represented as a data dependence Today Control-flow analysis

516 views • 5 slides
Flow and Congestion Control CS 218 F2003 Oct 29, 03 Flow control goals Classification

Flow and Congestion Control CS 218 F2003 Oct 29, 03 Flow control goals Classification

Flow and Congestion Control CS 218 F2003 Oct 29, 03 Flow control goals Classification and overview of main techniques TCP Tahoe, Reno, Vegas TCP Westwood Readings: (1) Keshavs book Chapter on Flow Control; (2)

374 views • 22 slides
Flow Control: boolean expressions, if selec5on statements

Flow Control: boolean expressions, if selec5on statements

CS 101 Lecture 25 Flow Control: boolean expressions, if selec5on statements (Alice In Ac5on, Ch 4) Slides Credit: Joel Adams, Alice in Action Flow Control Flow: sequence of

391 views • 15 slides
Control flow Conditionals and Control Flow l A conditional branch

Control flow Conditionals and Control Flow l A conditional branch

10/2/15 Control flow Conditionals and Control Flow l A conditional branch is sufficient to implement most control Condition codes flow constructs offered in higher

356 views • 12 slides
Lecture 11 Control-flow Hijacking Defenses Stephen Checkoway Oberlin College Slides adapted

Lecture 11 Control-flow Hijacking Defenses Stephen Checkoway Oberlin College Slides adapted

Lecture 11 Control-flow Hijacking Defenses Stephen Checkoway Oberlin College Slides adapted from Miller, Bailey, and Brumley Control Flow Hijack: Always control + computation shellcode (aka payload) padding &buf computation +

688 views • 36 slides
Flow of Control Flow of Control Recitation 09/(11,12)/2008 CS 180 CS 180 Department of

Flow of Control Flow of Control Recitation 09/(11,12)/2008 CS 180 CS 180 Department of

Flow of Control Flow of Control Recitation 09/(11,12)/2008 CS 180 CS 180 Department of Computer Science, Purdue University Project 2 j Now posted on the class webpage. Due Wed, Sept. 17 at 10 pm. Start early All

663 views • 22 slides
x86 CONTROLLING PROGRAM FLOW CONTROL FLOW Computers execute instructions in sequence...

x86 CONTROLLING PROGRAM FLOW CONTROL FLOW Computers execute instructions in sequence...

x86 CONTROLLING PROGRAM FLOW CONTROL FLOW Computers execute instructions in sequence... ...Except when we change the flow of control. Two main ways of doing this: Jump instructions (this lecture) Call instructions

517 views • 29 slides
Conditionals & Control Flow Announcements For This Lecture Readings Assignment 1

Conditionals & Control Flow Announcements For This Lecture Readings Assignment 1

Lecture 8 Conditionals & Control Flow Announcements For This Lecture Readings Assignment 1 Sections 5.1-5.7 today Due TONIGHT Chapter 4 for Tuesday Due before midnight Submit something Assignment 2 Can

554 views • 33 slides
Conditionals & Control Flow Announcements For This Lecture Assignment 1 Partners

Conditionals & Control Flow Announcements For This Lecture Assignment 1 Partners

Lecture 7 Conditionals & Control Flow Announcements For This Lecture Assignment 1 Partners Should be working on it You must pair in CMS Have covered everything Go into the submission Look at lab for more help Request

752 views • 38 slides
CSCI341 Lecture 31, Control RECALL... The datapath is a representation of the flow of

CSCI341 Lecture 31, Control RECALL... The datapath is a representation of the flow of

CSCI341 Lecture 31, Control RECALL... The datapath is a representation of the flow of information (data, instructions) through the CPU Implemented as combination of circuitry and combinatorial & sequential chips In order

456 views • 23 slides
V3 1/3/2015 Programming in C 1 Flow of Control Flow of control The order in which

V3 1/3/2015 Programming in C 1 Flow of Control Flow of control The order in which

V3 1/3/2015 Programming in C 1 Flow of Control Flow of control The order in which statements are executed Transfer of control When the next statement executed is not the next one in sequence 2 Flow of Control Control

310 views • 12 slides
Programming in C 1 Flow of Control Flow of control The order in which statements are

Programming in C 1 Flow of Control Flow of control The order in which statements are

Programming in C 1 Flow of Control Flow of control The order in which statements are executed Transfer of control When the next statement executed is not the next one in sequence 2 Flow of Control Control structures

540 views • 34 slides
Control Structures in Java if-else and switch Lecture 4 CGS 3416 Spring 2016 February 2, 2016

Control Structures in Java if-else and switch Lecture 4 CGS 3416 Spring 2016 February 2, 2016

Control Structures in Java if-else and switch Lecture 4 CGS 3416 Spring 2016 February 2, 2016 Control Flow Control flow refers to the specification of the order in which the individual statements, instructions or function calls of an

639 views • 19 slides
Exceptional Control Flow: Hardware support for reacting to the rest of the world. Control Flow

Exceptional Control Flow: Hardware support for reacting to the rest of the world. Control Flow

Exceptional Control Flow: Hardware support for reacting to the rest of the world. Control Flow Processor: read instruction, execute it, go to next instruction, repeat Physical control flow Explicit changes: Jumps (conditional, unconditional)

428 views • 8 slides
ex 1. compare and test : conditions Aside: save conditions b,a computes a - b , sets flags,

ex 1. compare and test : conditions Aside: save conditions b,a computes a - b , sets flags,

Conditionals and Control Flow Two key pieces 1. Comparisons and tests: check conditions 2. Transfer control: choose next instruction Control flow Processor Control-Flow State Familiar C constructs Condition codes (a.k.a. flags ) if else l

191 views • 8 slides
Conditionals & Control Flow Announcements For This Lecture Assignment 1 Partners

Conditionals & Control Flow Announcements For This Lecture Assignment 1 Partners

Presentation 7 Conditionals & Control Flow Announcements For This Lecture Assignment 1 Partners Should be working on it You must pair in CMS Have covered everything Go into the submission Look at lab for more help

569 views • 29 slides
Flow Control: Repetition with For Loops (Alice In Action, Ch 4) 21 September 2012 Slides

Flow Control: Repetition with For Loops (Alice In Action, Ch 4) 21 September 2012 Slides

CS 120 Lecture 08 Flow Control: Repetition with For Loops (Alice In Action, Ch 4) 21 September 2012 Slides Credit: Joel Adams, Alice in Action Flow of Control Sequential Execution Each instruction is executed in order they are written

557 views • 18 slides
Lecture 04 Control Flow II Stephen Checkoway CS 343 Fall 2020 Based on Michael

Lecture 04 Control Flow II Stephen Checkoway CS 343 Fall 2020 Based on Michael

Lecture 04 Control Flow II Stephen Checkoway CS 343 Fall 2020 Based on Michael Baileys ECE 422 32-bit x86 architecture overview 8 general purpose registers eax, ebx, ecx, edx, esi, edi, ebp, esp esp is the stack pointer

368 views • 23 slides
Python language: Control Flow The FOSSEE Group Department of Aerospace Engineering IIT Bombay

Python language: Control Flow The FOSSEE Group Department of Aerospace Engineering IIT Bombay

Python language: Control Flow The FOSSEE Group Department of Aerospace Engineering IIT Bombay Mumbai, India FOSSEE Team (FOSSEE IITB) Control flow 1 / 32 Outline Control flow 1 Basic Conditional flow Control flow 2 Basic Looping

560 views • 37 slides
Optimal Control of Plane Poiseuille Flow Workshop on Flow Control, Poitiers 11-14th Oct 04 J.

Optimal Control of Plane Poiseuille Flow Workshop on Flow Control, Poitiers 11-14th Oct 04 J.

Optimal Control of Plane Poiseuille Flow Workshop on Flow Control, Poitiers 11-14th Oct 04 J. Mckernan , J.F .Whidborne , G.Papadakis Cranfield University, U.K. Kings College, London, U.K. Optimal Control of

572 views • 22 slides

More recommend