Process Memory Linux

Posted by Eric | Linux, exploits | Wednesday 5 March 2008 10:03 am

<meta content="OpenOffice.org 2.0 (Linux)" name="GENERATOR" /><meta content="20080305;7343200" name="CREATED" /><meta content="16010101;0" name="CHANGED" /><br /> <style> <!-- @page { size: 8.5in 11in; margin: 0.79in } P { margin-bottom: 0.08in } --> </style> <p style="margin-bottom: 0in">Every Process has an address space with three segments: Text (code), Data, and Stack.</p> <p style="margin-bottom: 0in"> <p style="margin-bottom: 0in">The Text segment ,sometimes also called code segment contains the machine instructions that form the programs executable code. This section is usually read only and is generated by the compiler.</p> <p style="margin-bottom: 0in"> <p style="margin-bottom: 0in">The Data segment contains storage for program variables, strings, arrays and other data. This segment contains two parts, initialized and uninitialized data. The Uninitialized portion is known (historically at least) as BSS. The data segment can change, unlike the text(code) segment.</p> <p style="margin-bottom: 0in"> <p style="margin-bottom: 0in">The Stack Segment starts at the top of the Virtual Address Space and grows down towards 0. If the stack grows beyond its bounds a hardware fault occurs and the operation system lowers the bottom of the stack by 1 page. When you start a program all its variables and command line arguments are stored on the stack segment. This last statement should connect in your memory and fill in the “why” from any tutorials you may have read, which did something like strcpy(buffer, argv[1]).</p> <p style="margin-bottom: 0in"> <pre>Process Memory Layout: (Borrowed w/o permission from tutorial by: xgc/dx A.K.A Thyago Silva http://milw0rm.com/papers/4) 0xc0000000</pre> <pre>--------------------- | | | env/argv pointer. | | argc | |-------------------| | | | stack | | | | | | | | | | V | / / | | | ^ | | | | | | | | | | heap | |-------------------| | bss | |-------------------| | initialized data | |-------------------| | text | |-------------------| | shared libraries | | etc. | |-------------------|</pre> <pre>0x8000000</pre> <p style="margin-bottom: 0in">Above when discussing the stack segment we briefly mentioned that the operating system will increase the stack by 1 page when it grows out of its boundaries. A page is a 4Kb area of memory and is the basic unit of memory with which both the kernel and the CPU deal. Although both can access individual bytes (or even bits), the amount of memory that is managed is usually in pages. For more information on Linux paging and the linux memory model in general see <a href="http://www.ibm.com/developerworks/linux/library/l-memmod/">This link</a></p> </div> <div class="feedback"> <a href="http://hamsterswheel.com/techblog/?p=48#respond" title="Comment on Process Memory Linux">Comments (0)</a> </div> </div> <div class="post"> <h2 id="post-46"><a href="http://hamsterswheel.com/techblog/?p=46" rel="bookmark">The Briefest ELF intro EVAR!</a></h2> <div class="meta">Posted by Eric | <a href="http://hamsterswheel.com/techblog/?cat=3" title="View all posts in Linux" rel="category">Linux</a>, <a href="http://hamsterswheel.com/techblog/?cat=11" title="View all posts in Research" rel="category">Research</a> | Sunday 2 March 2008 1:15 am </div> <div class="storycontent"> <p><meta content="text/html; charset=utf-8" http-equiv="CONTENT-TYPE" /><title /><meta content="OpenOffice.org 2.0 (Linux)" name="GENERATOR" /><meta content="20080301;22530800" name="CREATED" /><meta content="16010101;0" name="CHANGED" /><br /> <style> <!-- @page { size: 8.5in 11in; margin: 0.79in } P { margin-bottom: 0.08in } --> </style> <p style="margin-bottom: 0in">March marks a new month and lately that means a new topic for discussion and research on the blog. This month I’ve chosen a going back to basics tour dealing with linux exploitation. I’ve created a general outline to follow and will begin this evening with a few words on the Elf Format. There are a few tutorials out there already so I will make this brief.</p> <p style="margin-bottom: 0in"> <p style="margin-bottom: 0in">The Elf Format is a common standard for object files in linux, unix and unix like operating systems. The three main types of object files are:</p> <p style="margin-bottom: 0in"> <p style="margin-bottom: 0in">Relocatable file which holds code and data suitable for linking with other files</p> <p style="margin-bottom: 0in">Executable files- which hold a program suitable for execution.</p> <p style="margin-bottom: 0in">Share objects – which holds code and data suitable for linking</p> <p style="margin-bottom: 0in"> <p style="margin-bottom: 0in">The ELF Format can be view visually as the following:</p> <p style="margin-bottom: 0in"> <p style="margin-bottom: 0in"><a href="http://upload.wikimedia.org/wikipedia/commons/thumb/7/77/Elf-layout--en.svg/200px-Elf-layout--en.svg.png"><img src="http://upload.wikimedia.org/wikipedia/commons/thumb/7/77/Elf-layout--en.svg/200px-Elf-layout--en.svg.png" /><br /> </a></p> <p style="margin-bottom: 0in"> <p style="margin-bottom: 0in">Each ELF file has an elf header followed by data which includes:</p> <ul> <li> <p style="margin-bottom: 0in">program header table</p> </li> <li> <p style="margin-bottom: 0in">section header table</p> </li> <li> <p style="margin-bottom: 0in">data referred to by entries in the program</p> </li> </ul> <p style="margin-bottom: 0in"> <p style="margin-bottom: 0in"> <p style="margin-bottom: 0in">The ELF Header is located at the beginning of the file and is used to describe the files internal organization.</p> <p style="margin-bottom: 0in">Similar to PECOFF, The Sections hold the bulk of information such as instructions, data, symbol table and location info.</p> <p style="margin-bottom: 0in"> <p> <!-- Begin Google Adsense code --> <script type="text/javascript"><!-- google_ad_client = "pub-9774791470740882"; google_ad_width = 468; google_ad_height = 60; google_ad_format = "468x60_as"; google_ad_type = "text_image"; google_ad_channel =""; //--></script> <script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script> <!-- End Google Adsense code --> </p> <p style="margin-bottom: 0in">For more information on ELF you can visit the following links, although some of them are rather dry.</p> <p style="margin-bottom: 0in"><a href="http://www.linux-foundation.org/spec/book/ELF-generic/ELF-generic/book1.html">http://www.linux-foundation.org/spec/book/ELF-generic/ELF-generic/book1.html</a></p> <p style="margin-bottom: 0in"><a href="http://www.linux-foundation.org/spec/book/ELF-IA32/ELF-IA32/book1.html">http://www.linux-foundation.org/spec/book/ELF-IA32/ELF-IA32/book1.html</a></p> <p style="margin-bottom: 0in"> <p style="margin-bottom: 0in"> <p style="margin-bottom: 0in">Next post we will be going into Linux Memory Management</p> </div> <div class="feedback"> <a href="http://hamsterswheel.com/techblog/?p=46#respond" title="Comment on The Briefest ELF intro EVAR!">Comments (0)</a> </div> </div> </div> <div id="footer"> © Copyright 2009 | <a href="http://hamsterswheel.com/techblog">Phn1x – Hamsterswheel</a> | Theme by <a href="http://clubparexcellancetech.com/">Club Par Excellance</a> | All Rights Reserved | Sponsored by <a href="http://www.voipkit.ca/">VoIP</a> </div> </body> </html>