assembly - 为什么以下汇编序列会发出 SIGILL 信号？

Question

这些都是有效的指令，直到 0x7fffffffdbe4 ，此时程序已经调用了退出系统调用。

gdb) x/20i $rip
    => 0x7fffffffdbb0:  movabs rax,0x2168732f6e69622f
       0x7fffffffdbba:  push   rax
       0x7fffffffdbbb:  lea    rdi,[rsp]
       0x7fffffffdbbf:  xor    rax,rax
       0x7fffffffdbc2:  mov    BYTE PTR [rdi+0x7],al
       0x7fffffffdbc5:  mov    QWORD PTR [rdi+0x8],rdi
       0x7fffffffdbc9:  mov    BYTE PTR [rdi+0x10],al
       0x7fffffffdbcc:  mov    rsi,QWORD PTR [rdi+0x8]
       0x7fffffffdbd0:  push   rax
       0x7fffffffdbd1:  push   rdi
       0x7fffffffdbd2:  mov    rsi,rsp
       0x7fffffffdbd5:  add    rax,0x3b
       0x7fffffffdbd9:  syscall 
       0x7fffffffdbdb:  add    rax,0x1
       0x7fffffffdbdf:  xor    rdi,rdi
       0x7fffffffdbe2:  syscall 
       0x7fffffffdbe4:  and    DWORD PTR [rcx],esp
       0x7fffffffdbe6:  and    DWORD PTR [rcx],esp
       0x7fffffffdbe8:  mov    al,0xdb
       0x7fffffffdbea:  (bad)  

在 之后出现意外行为0x7fffffffdbb1 指令被称为，这是我无法理解的。

(gdb) nexti
0x00007fffffffdbba in ?? ()
(gdb) nexti
Warning:
Cannot insert breakpoint 0.
Cannot access memory at address 0x2168732f6e69622f

0x00007fffffffdbbb in ?? ()
(gdb) i r rsp
rsp            0x7fffffffdbe8   0x7fffffffdbe8
(gdb) i r rip
rip            0x7fffffffdbbb   0x7fffffffdbbb
(gdb) nexti
0x00007fffffffdbbf in ?? ()
(gdb) nexti
0x00007fffffffdbc2 in ?? ()
(gdb) nexti
0x00007fffffffdbc5 in ?? ()
(gdb) nexti
0x00007fffffffdbc9 in ?? ()
(gdb) nexti
0x00007fffffffdbcc in ?? ()
(gdb) nexti
0x00007fffffffdbd0 in ?? ()
(gdb) nexti
Warning:
Cannot insert breakpoint 0.
Cannot access memory at address 0x0

0x00007fffffffdbd1 in ?? ()
(gdb) nexti

Program received signal SIGILL, Illegal instruction.
0x00007fffffffdbd9 in ?? ()
(gdb) 

我发布的输出开始于 0x7ffffffffdbba 给定的 gdb 似乎无法在地址(插入堆栈的值)然后在地址 0 设置断点。

Answer 1

正如一些人提到的，你正在用堆栈和你的 mov 粉碎代码。至 [rdi] .然而，mov碰巧rsp - 8所以地址0x7ffffffffdbd0应该没问题。

我认为问题是因此而发生的。您应该在每个 x/20i $rip 之后查看程序( push )和 mov [rdi+x], ?看看它变成了什么。它可能是有效的代码......它可能不是，结果是 SIGILL。

=> 0x7fffffffdbb0:  movabs rax,0x2168732f6e69622f
   0x7fffffffdbba:  push   rax
   0x7fffffffdbbb:  lea    rdi,[rsp]
   0x7fffffffdbbf:  xor    rax,rax
   0x7fffffffdbc2:  mov    BYTE PTR [rdi+0x7],al
   0x7fffffffdbc5:  mov    QWORD PTR [rdi+0x8],rdi
   0x7fffffffdbc9:  mov    BYTE PTR [rdi+0x10],al
   0x7fffffffdbcc:  mov    rsi,QWORD PTR [rdi+0x8]
   0x7fffffffdbd0:  push   rax                    <-- after "push rdi" (0x7fffffffdbd0)
   0x7fffffffdbd1:  push   rdi
   0x7fffffffdbd2:  mov    rsi,rsp
   0x7fffffffdbd5:  add    rax,0x3b
   0x7fffffffdbd9:  syscall                       <-- after 2nd "push rax" (0x7fffffffdbd8)
   0x7fffffffdbdb:  add    rax,0x1
   0x7fffffffdbdf:  xor    rdi,rdi
   0x7fffffffdbe2:  syscall                       <-- after 1st "push rax" (0x7fffffffdbe0)
   0x7fffffffdbe4:  and    DWORD PTR [rcx],esp
   0x7fffffffdbe6:  and    DWORD PTR [rcx],esp    <-- mov [rdi+7] (0x7fffffffdbe7)
   0x7fffffffdbe8:  mov    al,0xdb                <-- stack starts here
   0x7fffffffdbea:  (bad)