Chapter 10, Problem 19RQ

1 typedef struct node* { 2 struct node* next; 3 char* key; 4 char* val; 5} node_t; 6 7 char* find_node (node_t* node, char* key_to_find) { while(strcmp (node->key, key_to_find ) != 0 ) { node = node->next; 8 9 10 } 11 return node->val; 12 }

Match each of the assembler routines on the left with the equivalent C function on the right. Write the name of the label (e.g., foo) to the right of the corresponding function. Note: shrq is the logical right shift instruction, and sarq is the arithmetic right shift instruction. foo1: leaq 0(,%rdi, 8), %rax long choice1 (long x) { ret return x - 8 >8; foo3: } movq sarq %rdi, %rax $8, %rax long choice4 (long x) ret { return x*256; } foo4: long choice5 (long x) leaq -8 (%rdi), %rax { ret return x-8; } long choice6 (long x) foo5: { leaq -8 (%rdi), %rax return x+8; shrq $63, %rax } ret

Given the variables and code in the text below, identify where in memory they will live once the code is compiled. 1 char big_array [1L<<24]; /* 16 MB */ 2 GB * :/ 2 char huge_array [1L<<31]; /* 3 4 int global = 0; 5 6 int useless () { return 0; } 7 8 int main() 9 { 10 void *p1, p2, *p3, *p4; int local = 0; malloc (1L << 28); /* 256 MB *, 11 12 p1 13 p2 = malloc (1L << 8); /* 256 B * 14 p3 15 p4 = malloc (1L << 32); malloc (1L << 8); /* 4 GB * */ /* 256 B */ 16 } Note: *pN is the thing at which pN points. 1. big_array 2. huge_array 3. global 4. useless 5. void* p1 6. *p1 7. void* p2 8. *p2 9. void* p3 10. *p3 11. void* p4 12. *p4

The next problem concerns the following C code: /copy input string x to buf */ void foo (char *x) { char buf [8]; strcpy((char *) buf, x); } void callfoo() { } foo("ZYXWVUTSRQPONMLKJIHGFEDCBA"); Here is the corresponding machine code on a Linux/x86 machine: 0000000000400530 : 400530: 48 83 ec 18 sub $0x18,%rsp 400534: 48 89 fe mov %rdi, %rsi 400537: 48 89 e7 mov %rsp,%rdi 40053a: e8 di fe ff ff callq 400410 40053f: 48 83 c4 18 add $0x18,%rsp 400543: c3 retq 400544: 0000000000400544 : 48 83 ec 08 sub $0x8,%rsp 400548: bf 00 06 40 00 mov $0x400600,%edi 40054d: e8 de ff ff ff callq 400530 400552: 48 83 c4 08 add $0x8,%rsp 400556: c3 This problem tests your understanding of the program stack. Here are some notes to help you work the problem: ⚫ strcpy(char *dst, char *src) copies the string at address src (including the terminating '\0' character) to address dst. It does not check the size of the destination buffer. • You will need to know the hex values of the following characters:

Consider the following assembly code for a C for loop: movl $0, %eax jmp .L2 .L3: addq $1, %rdi addq %rsi, %rax subq $1, %rsi .L2: cmpq %rsi, %rdi jl .L3 addq ret %rdi, %rax Based on the assembly code above, fill in the blanks below in its corresponding C source code. Recall that registers %rdi and %rsi contain the first and second, respectively, argument of a function. (Note: you may only use the symbolic variables x, y, and result in your expressions below do not use register names.) long loop (long x, long y) { long result; } for ( } return result; __; y--) {

In each of the following C code snippets, there are issues that can prevent the compiler from applying certain optimizations. For each snippet: Circle the line number that contains compiler optimization blocker. ⚫ Select the best modification to improve optimization. 1. Which line prevents compiler optimization? Circle one: 2 3 4 5 6 Suggested solution: ⚫ Remove printf or move it outside the loop. Remove the loop. • Replace arr[i] with a constant value. 1 int sum (int *arr, int n) { 2 int s = 0; 3 for (int i = 0; i < n; i++) { 4 5 6 } 7 8 } s = arr[i]; printf("%d\n", s); return s; 234206 2. Which line prevents compiler optimization? Circle one: 2 3 4 5 6 Suggested solution: Move or eliminate do_extra_work() if it's not necessary inside the loop. Remove the loop (but what about scaling?). ⚫ Replace arr[i] *= factor; with arr[i] = 0; (why would that help?). 1 void scale (int *arr, int n, int factor) { 5 6 } for (int i = 0; i < n; i++) { rr[i] = factor; do_extra_work ();

123456 A ROP (Return-Oriented Programming) attack can be used to execute arbitrary instructions by chaining together small pieces of code called "gadgets." Your goal is to create a stack layout for a ROP attack that calls a function located at '0x4018bd3'. Below is the assembly code for the function 'getbuf', which allocates 8 bytes of stack space for a 'char' array. This array is then passed to the 'gets' function. Additionally, you are provided with five useful gadgets and their addresses. Use these gadgets to construct the stack layout. Assembly for getbuf 1 getbuf: sub mov $8, %rsp %rsp, %rdi call gets add $8, %rsp ret #Allocate 8 bytes for buffer #Load buffer address into %rdi #Call gets with buffer #Restore the stack pointer #Return to caller Stack Layout each 8-byte (fill in section) Address Value (8 bytes) 0x7fffffffdfc0 0x7fffffffdfb8 0x7fffffffdfb0 0x7fffffffdfa8 0x7fffffffdfa0 0x7fffffffdf98 0x7fffffffdf90 0x7fffffffdf88 Gadgets Address Gadget Ox4006a7 pop %rdi; ret Ox4006a9…

Problem 1 [15 points] The code below is buggy. Assume the code compiles. Briefly: 1). Identify the problem with the code (e.g., can access memory out of bounds) and 2). Suggest a solution (e.g., check the length). Question 1 1 #define BLENGTH 5 2 int b[BLENGTH]; 3 void copy_from_global_int_array_b (int n, int* dest) { 4 5 } *dest = b[n]; ==

Which statement regarding SGA_MAX_SIZE is true? SGA_MAX_SIZE is modifiable after an instance is started, only when Automatic Memory Management is used. SGA_MAX_SIZE is not dyamically modifiable. SGA_MAX_SIZE is ignored when MEMORY_TARGET > 0. SGA-MAX_SIZE must be specified when SGA_TARGET > 0