• State Accepted Answer
  • Locked Locked
  • Replies 6 replies
  • Subscribers 20 subscribers
  • Views 16290 views
  • Users 0 members are here
Options
Related
How was your experience today?
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ADRP command getting crashed.

DeepakHegde

Writing an assembly code and want to make the ASLR (Address Space Layout Randomisation) complaint code. 

armb8le platform (64 bit)

Previously was using LDR command to load the fork function as below:

ldr x4,=ASM_NAME(forkx)

From the ARM manual came to know that the for PC relative jump we need to use the ADR command and which will make it ASLR complaint. So now using ADRP command as below, chosen ADRP because of relative jump is more in this case, also ADR command used to give error.

adrp x4, ASM_NAME(forkx)

After doing this, now my binary generated the free of textrel segment and ASLR complaint.

But when i load the image it is getting crashed and traceback point to the function where this changes are done.

Also after loading x4 is getting used with load and store operation.

Please can anyone help in this? is there any problem in using these instruction like this?

Parents
  • 0 in reply to Ronan Synnott

    Thanks for the reply Ronam,

    Able to debug more on this, following is the code that i have:

    53      adrp x4,ASM_NAME(forkx)
    54      ldr x1,[x4]
    55      ldr     x5, [x1, #savedSPFP]


    Able to load the gdb and backtrace from the trace crash is as "ldr x5, [x1, #savedSPFP]". following is the analysis:

    1. We can see the register content at the time of crash as below, and x1 have the value 0x0 and  x4 have 0x55783dd000

    (gdb) info registers

    x0             0x30a0   12448

    x1             0x0      0

    x2             0x7fdf1bf6b0     549203998384

    x3             0x55ad57f898     367980443800

    x4             0x55783dd000     367089537024

    x5             0x0      0

    x6             0x1      1

    2. With ldr           x5, [x1, #savedSPFP] is trying to access the addess x1+0x8 which means 0x0+0x8 = 0x8 and this address can not be accessed and get crashed.

    (gdb) x/32 0x8

    0x8:    Cannot access memory at address 0x8

     

     3. X1 we are populating as ldr x1,[x4], which is content of x4 means value in address 0x55783dd000. Which is ZERO as per GDB.

    (gdb) x/32 0x55783dd000

    0x55783dd000 <__be_tgRandomDS0Ptr+80>:  0x00000000      0x00000000      0x00000000      0x00000000

     

     4. Address we are getting from the instruction adrp x4,ASM_NAME(forkx) , here We are loading forkx structure address to x4, if we see the address of the forkx we can see below:

    (gdb) print &forkx

    $13 = (sprocess * __be *) 0x55783dd5c0 <__be_forkx>

     

     5. And we can see at this address following content:

    (gdb) x/32 0x55783dd5c0

    0x55783dd5c0 <__be_forkx>:      0x7f008000      0x60804d6c      0x04000000      0x00000000

    So can you input why is x4 register is getting the value 0x55783dd000? is should have been0x55783dd5c0. Thanks. 

Reply
  • 0 in reply to Ronan Synnott

    Thanks for the reply Ronam,

    Able to debug more on this, following is the code that i have:

    53      adrp x4,ASM_NAME(forkx)
    54      ldr x1,[x4]
    55      ldr     x5, [x1, #savedSPFP]


    Able to load the gdb and backtrace from the trace crash is as "ldr x5, [x1, #savedSPFP]". following is the analysis:

    1. We can see the register content at the time of crash as below, and x1 have the value 0x0 and  x4 have 0x55783dd000

    (gdb) info registers

    x0             0x30a0   12448

    x1             0x0      0

    x2             0x7fdf1bf6b0     549203998384

    x3             0x55ad57f898     367980443800

    x4             0x55783dd000     367089537024

    x5             0x0      0

    x6             0x1      1

    2. With ldr           x5, [x1, #savedSPFP] is trying to access the addess x1+0x8 which means 0x0+0x8 = 0x8 and this address can not be accessed and get crashed.

    (gdb) x/32 0x8

    0x8:    Cannot access memory at address 0x8

     

     3. X1 we are populating as ldr x1,[x4], which is content of x4 means value in address 0x55783dd000. Which is ZERO as per GDB.

    (gdb) x/32 0x55783dd000

    0x55783dd000 <__be_tgRandomDS0Ptr+80>:  0x00000000      0x00000000      0x00000000      0x00000000

     

     4. Address we are getting from the instruction adrp x4,ASM_NAME(forkx) , here We are loading forkx structure address to x4, if we see the address of the forkx we can see below:

    (gdb) print &forkx

    $13 = (sprocess * __be *) 0x55783dd5c0 <__be_forkx>

     

     5. And we can see at this address following content:

    (gdb) x/32 0x55783dd5c0

    0x55783dd5c0 <__be_forkx>:      0x7f008000      0x60804d6c      0x04000000      0x00000000

    So can you input why is x4 register is getting the value 0x55783dd000? is should have been0x55783dd5c0. Thanks. 

Children