How to corrupt the stack in a C program

Question

I have to change the designated section of function_b so that it changes the stack in such a way that the program prints:

Executing function_a
Executing function_b
Finished!

At this point it also prints Executed function_b in between Executing function_b and Finished!.

I have the following code and I have to fill something in, in the part where it says // ... insert code here

#include <stdio.h>

void function_b(void){
char buffer[4];

// ... insert code here

fprintf(stdout, "Executing function_b\n");
}

void function_a(void) {
int beacon = 0x0b1c2d3;
fprintf(stdout, "Executing function_a\n");
function_b();
fprintf(stdout, "Executed function_b\n");
}

int main(void) {
function_a();
fprintf(stdout, "Finished!\n");
return 0;
}

I am using Ubuntu Linux with the gcc compiler. I compile the program with the following options: -g -fno-stack-protector -fno-omit-frame-pointer. I am using an intel processor.

Answer 1

Here is a solution, not exactly stable across environments, but works for me on x86_64 processor on Windows/MinGW64. It may not work for you out of the box, but still, you might want to use a similar approach.

void function_b(void) {
    char buffer[4];
    buffer[0] = 0xa1; // part 1
    buffer[1] = 0xb2;
    buffer[2] = 0xc3;
    buffer[3] = 0x04;
    register int * rsp asm ("rsp"); // part 2
    register size_t r10 asm ("r10");
    r10 = 0;
    while (*rsp != 0x04c3b2a1) {rsp++; r10++;} // part 3
    while (*rsp != 0x00b1c2d3) rsp++; // part 4
    rsp -= r10; // part 5
    rsp = (int *) ((size_t) rsp & ~0xF); // part 6
    fprintf(stdout, "Executing function_b\n");
}

The trick is that each of function_a and function_b have only one local variable, and we can find the address of that variable just by searching around in the memory.

1. First, we put a signature in the buffer, let it be the 4-byte integer 0x04c3b2a1 (remember that x86_64 is little-endian).

2. After that, we declare two variables to represent the registers: rsp is the stack pointer, and r10 is just some unused register. This allows to not use asm statements later in the code, while still being able to use the registers directly. It is important that the variables don't actually take stack memory, they are references to processor registers themselves.

3. After that, we move the stack pointer in 4-byte increments (since the size of int is 4 bytes) until we get to the buffer. We have to remember the offset from the stack pointer to the first variable here, and we use r10 to store it.

4. Next, we want to know how far in the stack are the instances of function_b and function_a. A good approximation is how far are buffer and beacon, so we now search for beacon.

5. After that, we have to push back from beacon, the first variable of function_a, to the start of instance of the whole function_a on the stack. That we do by subtracting the value stored in r10.

6. Finally, here comes a werider bit. At least on my configuration, the stack happens to be 16-byte aligned, and while the buffer array is aligned to the left of a 16-byte block, the beacon variable is aligned to the right of such block. Or is it something with a similar effect and different explanation?.. Anyway, so we just clear the last four bits of the stack pointer to make it 16-byte aligned again. The 32-bit GCC doesn't align anything for me, so you might want to skip or alter this line.

---

When working on a solution, I found the following macro useful:

#ifdef DEBUG
#define show_sp() \
    do { \
        register void * rsp asm ("rsp"); \
        fprintf(stdout, "stack pointer is %016X\n", rsp); \
    } while (0);
#else
#define show_sp() do{}while(0);
#endif

After this, when you insert a show_sp(); in your code and compile with -DDEBUG, it prints what is the value of stack pointer at the respective moment. When compiling without -DDEBUG, the macro just compiles to an empty statement. Of course, other variables and registers can be printed in a similar way.

Answer 2

ok, let assume that epilogue (i.e code at } line) of function_a and for function_b is the same

despite functions A and B not symmetric, we can assume this because it have the same signature (no parameters, no return value), same calling conventions and same size of local variables (4 byte - int beacon = 0x0b1c2d3 vs char buffer[4];) and with optimization - both must be dropped because unused. but we must not use additional local variables in function_b for not break this assumption. most problematic point here - what is function_A or function_B will be use nonvolatile registers (and as result save it in prologue and restore in epilogue) - but however look like here no place for this.

so my next code based on this assumption - epilogueA == epilogueB (really solution of @Gassa also based on it.

also need very clearly state that function_a and function_b must not be inline. this is very important - without this any solution impossible. so I let yourself add noinline attribute to function_a and function_b. note - not code change but attribute add, which author of this task implicitly implies but not clearly stated. don't know how in GCC mark function as noinline but in CL __declspec(noinline) for this used.

next code I write for CL compiler where exist next intrinsic function

void * _AddressOfReturnAddress();

but I think that GCC also must have the analog of this function. also I use

void* _ReturnAddress();

but however really _ReturnAddress() == *(void**)_AddressOfReturnAddress() and we can use _AddressOfReturnAddress() only. simply using _ReturnAddress() make source (but not binary - it equal) code smaller and more readable.

and next code is work for both x86 and x64. and this code work (tested) with any optimization.

despite I use 2 global variables - code is thread safe - really we can call main from multiple threads in concurrent, call it multiple time - but all will be worked correct (only of course how I say at begin if epilogueA == epilogueB)

hope comments in code enough self explained

__declspec(noinline) void function_b(void){
    char buffer[4];

    buffer[0] = 0;

    static void *IPa, *IPb;

    // save the IPa address
    _InterlockedCompareExchangePointer(&IPa, _ReturnAddress(), 0);

    if (_ReturnAddress() == IPa)
    {
        // we called from function_a
        function_b();
        // <-- IPb
        if (_ReturnAddress() == IPa)
        {
            // we called from function_a, change return address for return to IPb instead IPa
            *(void**)_AddressOfReturnAddress() = IPb;
            return;
        }
        // we at stack of function_a here.
        // we must be really at point IPa
        // and execute fprintf(stdout, "Executed function_b\n"); + '}' (epilogueA)
        // but we will execute fprintf(stdout, "Executing function_b\n"); + '}' (epilogueB)
        // assume that epilogueA == epilogueB
    }
    else
    {
        // we called from function_b
        IPb = _ReturnAddress();
        return;
    }

    fprintf(stdout, "Executing function_b\n");
    // epilogueB
}

__declspec(noinline) void function_a(void) {
    int beacon = 0x0b1c2d3;
    fprintf(stdout, "Executing function_a\n");
    function_b();
    // <-- IPa
    fprintf(stdout, "Executed function_b\n");
    // epilogueA
}

int main(void) {
    function_a();
    fprintf(stdout, "Finished!\n");
    return 0;
}