CS356 : Discussion #4 Assembly Instructions & Debugging with GDB - PowerPoint PPT Presentation

CS356 : Discussion #4 Assembly Instructions & Debugging with GDB

Last week: Operand Forms Different ways to specify source values and output location. Immediate: $ imm to use a constant input value, e.g., $0xFF . Register: % reg to use the value contained in a register, e.g., %rax . Memory reference Absolute : addr , e.g., 0x1122334455667788 [use a fixed address] ● Indirect : (% reg ) , e.g., (%rax) [use the address contained in a q register ] ● Base+displacement : imm (% reg ) , e.g., 16(%rax) [add a displacement] ● Indexed: (% reg1 ,% reg2 ) , e.g., (%rax,%rbx) [add another register] ● ● Indexed+displacement: imm (% reg1 ,% reg2 ) [add both] ● Scaled indexed: imm (% reg1 ,% reg2 , c ) [use address: imm + reg1 + reg2 * c ] c must be one of 1, 2, 4, 8 Variants: omit imm or reg1 or both . E.g., (,%rax,4) (A memory reference selects the first byte.)

Last week: Data Movement Move to register/memory (register operands must match size codes) movb src, dst (1 byte) ● movw src, dst (2 bytes) ● movl src, dst (4 bytes / with register destination, the others are set to 0) ● movq src, dst (8 bytes) ● movabsq imm, reg (8 bytes / 64-bit source value allowed into register) ● ( movq only supports a 32-bit immediate; movabsq allows a 64-bit immediate) (Either src or dst can refer to a memory location, not both; no imm as dst .) Move from register/memory to register (zero extension) movzbw src, reg (byte to word) ● movzbl src, reg (byte to double word) ● movzbq src, reg (byte to quad word) ● movzwl src, reg (word to double word) ● movzwq src, reg (word to quad word) ● Same, but with sign extension (replicate MSB) : movsbw , movsbl , movsbq , movswl , movswq , movslq , cltq ( %eax to %rax ) ●

Arithmetic Instructions Unary (with q / l / w / b variants) Any instruction that generates a 32-bit ● incq x is equivalent to x++ value for a register also sets the high- ● decq x is equivalent to x-- order portion of the register to 0 . ● negq x is equivalent to x = -x notq x is equivalent to x = ~x ● Binary (with q / l / w / b variants) x,y is equivalent to y += x ● addq ● x,y is equivalent to y -= x subq ● imulq x,y is equivalent to y *= x Except for right shift, all instructions andq x,y is equivalent to y &= x ● are the same for signed/unsigned x,y is equivalent to y |= x values (thanks to 2’s -complement) ● orq x,y is equivalent to y ^= x ● xorq n,y is equivalent to y = y << n n is $imm or %cl (mod 32) ● salq n,y is equivalent to y = y >> n arithmetic : fill in sign bit from left ● sarq ● n,y is equivalent to y = y >> n logical : fill in zeros from left shrq

Arithmetic Instructions: Examples Values at each memory address: Values in registers: ● 0x100: 0xFF ● %rax: 0x100 ● 0x108: 0xAB ● %rcx: 0x1 ● 0x110: 0x13 ● %rdx: 0x3 ● 0x118: 0x11 Effect? ● addq %rcx,(%rax) ● subq %rdx,8(%rax) ● imulq $16,(%rax,%rdx,8) ● incq 16(%rax) ● decq %rcx ● subq %rdx,%rax

Arithmetic Instructions: Examples Values at each memory address: Values in registers: ● 0x100: 0xFF ● %rax: 0x100 ● 0x108: 0xAB ● %rcx: 0x1 ● 0x110: 0x13 ● %rdx: 0x3 ● 0x118: 0x11 Effect? Solutions: Write 0x100 at 0x100 ● addq %rcx,(%rax) Write 0xA8 at 0x108 ● subq %rdx,8(%rax) Write 0x110 at 0x118 ● imulq $16,(%rax,%rdx,8) Write 0x14 at 0x110 ● incq 16(%rax) Write 0x0 inside %rcx ● decq %rcx Write 0xFD inside %rax ● subq %rdx,%rax

leaq (Load Effective Address) leaq src, reg ● Saves the first parameter into an 8-byte register ● The first parameter can be any displaced / indexed / scaled address Useful for: Saving an address for later use. ● Performing simple additions and constant multiplication: ● leaq imm(reg1,reg2,c), reg3 saves imm+reg1+reg2*c into reg3 ● Only one instruction is used: efficient! Examples ( %rax = x, %rcx = y) leaq 6(%rax),%rdx saves (6+x) in %rdx ● leaq (%rax,%rcx),%rdx saves (x+y) in %rdx ● leaq (%rax,%rcx,4),%rdx saves (x+4*y) in %rdx ● ● leaq 7(%rax,%rax,8),%rdx saves (7+9*x) in %rdx leaq 0xA(,%rcx,4),%rdx saves (10+4*y) in %rdx ●

Fill In the Missing C Expression The assembly code on the right is produced by the compiler. What is a corresponding C expression for the input code? long scale ( long x, long y, long z) { scale: // x in %rdi , y in %rsi , z in %rdx leaq (%rdi,%rdi, 4 ), %rax // output saved in %rax leaq (%rax,%rsi, 2 ), %rax return ??? leaq (%rax,%rdx, 8 ), %rax } ret

Fill In the Missing C Expression The assembly code on the right is produced by the compiler. What is a corresponding C expression for the input code? long scale ( long x, long y, long z) { long scale ( long x, long y, long z) { scale: // x in %rdi , y in %rsi , z in %rdx // x in %rdi , y in %rsi , z in %rdx leaq (%rdi,%rdi, 4 ), %rax // output saved in %rax // output saved in %rax leaq (%rax,%rsi, 2 ), %rax return ??? return 5 *x + 2 *y + 8 *z; leaq (%rax,%rdx, 8 ), %rax } } ret

BombLab

BombLab

BombLab

Example: Conditionals dist: long dist ( long x, long y) { cmpq %rsi, %rdi // x in %rdi , y in %rsi jg .L4 // output saved in %rax movq %rsi, %rax if (x > y) subq %rdi, %rax return x - y; ret else .L4: return y – x; movq %rdi, %rax } subq %rsi, %rax ret

BombLab Goal: to defuse a “binary bomb” by figuring out the correct inputs. ● A sequence of 8 phases: each phase asks for an input from stdin . ● If the correct input is provided, the program proceeds to the next phase . ● If the wrong input is provided, the program terminates with an “explosion.” Your goal is to complete all phases. You must figure out the correct inputs by disassembling the binary program that is already in your GitHub repository . Complete the assignment inside the VM (must have internet connection). ● The binary program pings our server. ● ● Commit and push your solution files sol1.txt through sol8.txt to GitHub.

gdb : The GNU Debugger Goal: “To help you catch bugs in the act.” How? ● Start your program (specifying inputs). Pause it when a condition is met (breakpoints). ● For a fish, the archer fish is known to Examine the current state (inspect). ● shoot down bugs from low hanging plants Proceed step-by-step (understand). ● by spitting water at them. — Jamie Guinan | https://goo.gl/VxsgbU Getting started ● Install gdb: apt-get install gdb (already present on your VM) Include debugging information: gcc -g hello.c -o hello ● Run gdb on your binary program: ● $ gdb hello Reading symbols from hello...done. (gdb) _

User Interface An interactive shell ● Autocomplete a command with tab ● Scroll history of previous commands with up / down ● Repeat the previous command with enter Commands can often be abbreviated with few letters (in red ) ● Help about a command: (gdb) help <command> ● Open a file for debug: (gdb) file <binary file> ● Quit: (gdb) quit ● Looking at the C code Show 10 lines around beginning of a function: (gdb) list func_name ● Show next 10 lines: (gdb) list ● Set how many lines to show: (gdb) set linesize 20 ● A bit tedious! There is a more practical interface: gdb -tui , the “terminal user interface”

User Interface Reloaded: gdb -tui Scroll through source code Enter commands

A few tips Moving the focus ● By pressing up / down / left / right, you scroll the source sub-window ● To scroll the history or move along the command line, you must set the focus on the other part of the screen: C-x o (press ctrl+x, release, press o) Redrawing the screen If your program prints to stdout, it will interfere with the TUI interface ● In case, you can redraw the screen with C-l ● Changing mode You can enable/disable the TUI mode with C-x a ● Or, you can select a mode: ● (gdb) layout src Show source and commands ○ (gdb) layout asm Show assembly and commands ○ (gdb) layout split Show source, assembly, commands ○ (gdb) layout regs Show registers ○

Layouts

Breakpoints and Control Flow Breakpoints ● Add at current location: (gdb) break Add at the beginning of a function: (gdb) break func_name ● ● Add at a specific line of a source file: (gdb) break hello.c:5 Add at a specific line of current file: (gdb) break 5 ● List all breakpoints: (gdb) info breakpoints ● Delete a breakpoint: (gdb) delete <breakpoint #> ● Disable/enable breakpoint: (gdb) disable <#> and (gdb) enable <#> ● Controlling the execution ● Run a program from start, until first breakpoint: (gdb) run <args> Advance your program execution manually ● Continue to the next line, executing subroutines: (gdb) next ○ Continue to the next line, stepping into subroutines: (gdb) step ○ Run until the next breakpoint: (gdb) continue ● Run until the end of the function and print return value: (gdb) finish ●