CODEWITHSUNDEEP
linuxassemblyreturnx86-64callstack
candido
candido

Reputation: 143

gnu assembly RET instruction on x86-64 architecture FAIL

The below program causes an SEGMENTATION FAULT. The RET instruction don't recover RETURN ADDRESS TO SYSTEM.

Debugging session with gdb, I can read that the return address IS NOT on the stack. Before the first instruction pushq %rbp the %rsp stack pointer reference the 0x00000000 address that is not the return address and cause the SEGMENTATION DEFAULT.

On debug session when I set the breakpoint on _start label the first instruction to execute is not the Epilogue.... it is the Prologue.

It is clear that the system calling operaion don't operate correctly with the stack pointer and don't save the return address.

I had not this problem on a old 32 bits platform.

¿Some idea? Thanks in advance.

gdb session:

Reading symbols from /home/candido/tutoriales/as_tutorial/examples/basicos_64/nada/ret_fault...done.
(gdb) b _start
Breakpoint 1 at 0x40007c: file ret_fault.s, line 15.
(gdb) run
Starting program: /home/candido/tutoriales/as_tutorial/examples/basicos_64/nada/ret_fault 
(gdb) x /x $rsp
0x7fffffffe068: 0x00000000
(gdb)

as source code:

###  Simple Prologue Epilogue Module
###  System call don't save the RETURN ADDRESS
###  Assembling: as -gstabs -o ret_fault.o ret_fault.s
###  Linking: ld -o ret_fault ret_fault.o
###  Execution: ./ret_fault
###  System warning:    SEGMENTATION FAULT
###  System platform: Linux lur 3.2.0-33-generic #52-Ubuntu SMP  x86_64 GNU/Linux
    .text           
    .globl  _start      
_start:             
    ## Epilogue
    pushq   %rbp        # save calling frame pointer
    movq    %rsp, %rbp  # set called frame pointer
    ## Prologue
    movl    $0, %eax    # set return value
    popq    %rbp        # restore calling frame pointer
    ret         # return to system. Get return address from stack and load on RIP register.
    .end

Upvotes: 1

Views: 1075

Answers (1)

nrz
nrz

Reputation: 10570

You can't use ret to end a program. You can use eg. syscall:

movq $0x60, %rax
xorq %rdi, %rdi
syscall

Upvotes: 2

Related Questions