c - 为什么这段代码可以获取到环境变量地址呢？

Question

64-bit Linux stack smashing tutorial: Part 1使用 Get environment variable address gist获取环境变量地址。先决条件是首先通过 echo 0 >/proc/sys/kernel/randomize_va_space 禁用 ASLR。

要点的内容是:

/*
 * I'm not the author of this code, and I'm not sure who is.
 * There are several variants floating around on the Internet, 
 * but this is the one I use. 
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char *argv[]) {
    char *ptr;

    if(argc < 3) {
        printf("Usage: %s <environment variable> <target program name>\n", argv[0]);
        exit(0);
    }
    ptr = getenv(argv[1]); /* get env var location */
    ptr += (strlen(argv[0]) - strlen(argv[2]))*2; /* adjust for program name */
    printf("%s will be at %p\n", argv[1], ptr);
}

为什么要用*2来调整程序名？

我的猜测是程序名在栈上保存了两次。

下图来自https://lwn.net/Articles/631631/提供更多细节:

------------------------------------------------------------- 0x7fff6c845000
 0x7fff6c844ff8: 0x0000000000000000
        _  4fec: './stackdump\0'                      <------+
  env  /   4fe2: 'ENVVAR2=2\0'                               |    <----+
       \_  4fd8: 'ENVVAR1=1\0'                               |   <---+ |
       /   4fd4: 'two\0'                                     |       | |     <----+
 args |    4fd0: 'one\0'                                     |       | |    <---+ |
       \_  4fcb: 'zero\0'                                    |       | |   <--+ | |
           3020: random gap padded to 16B boundary           |       | |      | | |

在此图中，./stackdump 用于执行程序。所以我可以看到程序名 ./stackdump 在环境字符串上面保存了一次。如果 ./stackdump 是从 Bash shell 启动的，Bashell 将使用键 _ 将其保存在环境字符串中:

_

(An underscore.) At shell startup, set to the absolute pathname used to invoke the shell or shell script being executed as passed in theenvironment or argument list. Subsequently, expands to the lastargument to the previous command, after expansion. Also set to thefull pathname used to invoke each command executed and placed in theenvironment exported to that command. When checking mail, thisparameter holds the name of the mail file.

环境字符串在堆栈之上。所以程序名又一次保存在栈上。

Answer 1

万一有人还在想为什么。这是因为程序名称除了在所有环境变量之前被压入堆栈之外，还存储在一个环境变量名称“_”中。

您可以通过将 gdb 附加到进程并检查最后一个环境变量下面的堆栈内容来检查这一点。假设0x7fffffffabcd是最后一个环境变量的地址:

$ gdb -p <pid>

(gdb) x/20s 0x7fffffffabcd

存储在 argv[0] 中的程序名称不会影响环境变量的地址，因为它位于堆栈中最后一个环境变量的顶部。