Storing keyboard Input in x64 assembly (Mac OS/X) - macos

I have been trying for some time now to get a number from a keyboard and comparing it with a value on the stack. If it is correct it will print "Hello World!" and if incorrect, it should print out "Nope!". However, what happens now is no matter the input "jne" is called, nope is printed, and segfault. Perhaps one of you could lend a hand.
.section __DATA,__data
str:
.asciz "Hello world!\n"
sto:
.asciz "Nope!\n"
.section __TEXT,__text
.globl _main
_main:
push %rbp
mov %rsp,%rbp
sub $0x20, %rsp
movl $0x0, -0x4(%rbp)
movl $0x2, -0x8(%rbp)
movl $0x2000003, %eax
mov $0, %edi
subq $0x4, %rsi
movq %rsi, %rcx
syscall
cmp -0x8(%rbp), %edx
je L1
jne L2
xor %rbx, %rbx
xor %rax, %rax
movl $0x2000001, %eax
syscall
L1:
xor %rax, %rax
movl $0x2000004, %eax
movl $1, %edi
movq str#GOTPCREL(%rip), %rsi
movq $14, %rdx
syscall
ret
L2:
xor %eax, %eax
movl $0x2000004, %eax
movl $1, %edi
movq sto#GOTPCREL(%rip), %rsi
movq $6, %rdx
syscall
ret

I would start with this OS/X Syscall tutorial (The 64-bit part in your case). It is written for NASM syntax but the important information is the text and links for the SYSCALL calling convention. The SYSCALL table is found on this Apple webpage. Additional information on the standard calling convention for 64-bit OS/X can be found in the System V 64-bit ABI.
Of importance for SYSCALL convention:
arguments are passed in order via these registers rdi, rsi, rdx, r10, r8 and r9
syscall number in the rax register
the call is done via the syscall instruction
what OS X contributes to the mix is that you have to add 0x20000000 to the syscall number (still have to figure out why)
You have many issues with with your sys_read system call. The SYSCALL table says this:
3 AUE_NULL ALL { user_ssize_t read(int fd, user_addr_t cbuf, user_size_t nbyte); }
So given the calling convention, int fd is in RDI, user_addr_t cbuf (pointer to character buffer to hold return data) is in RSI, and user_size_t nbyte (maximum bytes buffer can contain) is in RDX.
Your program seg faulted on the ret because you didn't have proper function epilogue to match the function prologue at the top:
push %rbp #
mov %rsp,%rbp # Function prologue
You need to do the reverse at the bottom, set the result code in RAX and then do the ret. Something like:
mov %rbp,%rsp # \ Function epilogue
pop %rbp # /
xor %eax, %eax # Return value = 0
ret # Return to C runtime which will exit
# gracefully and return to OS
I did other minor cleanup, but tried to keep the structure of the code similar. You will have to learn more assembly to better understand the code that sets up RSI with the address for sys_read SYSCALL . You should try to find a good tutorial/book on x86-64 assembly language programming in general. Writing a primer on that subject is beyond the scope of this answer.
Code that might be closer to what you were looking for that takes the above into account:
.section __DATA,__data
str:
.asciz "Hello world!\n"
sto:
.asciz "Nope!\n"
.section __TEXT,__text
.globl _main
_main:
push %rbp #
mov %rsp,%rbp # Function prologue
sub $0x20, %rsp # Allocate 32 bytes of space on stack
# for temp local variables
movl $0x2, -4(%rbp) # Number for comparison
# 16-bytes from -20(%rbp) to -5(%rbp)
# for char input buffer
movl $0x2000003, %eax
mov $0, %edi # 0 for STDIN
lea -20(%rbp), %rsi # Address of temporary buffer on stack
mov $16, %edx # Read 16 character maximum
syscall
movb (%rsi), %r10b # RSI = pointer to buffer on stack
# get first byte
subb $48, %r10b # Convert first character to number 0-9
cmpb -4(%rbp), %r10b # Did we find magic number (2)?
jne L2 # If No exit with error message
L1: # If the magic number matched print
# Hello World
xor %rax, %rax
movl $0x2000004, %eax
movl $1, %edi
movq str#GOTPCREL(%rip), %rsi
movq $14, %rdx
syscall
jmp L0 # Jump to exit code
L2: # Print "Nope"
xor %eax, %eax
movl $0x2000004, %eax
movl $1, %edi
movq sto#GOTPCREL(%rip), %rsi
movq $6, %rdx
syscall
L0: # Code to exit main
mov %rbp,%rsp # \ Function epilogue
pop %rbp # /
xor %eax, %eax # Return value = 0
ret # Return to C runtime which will exit
# gracefully and return to OS

Related

Finding the effective address of a label in GAS [duplicate]

This question already has answers here:
How to load address of function or label into register
(1 answer)
32-bit absolute addresses no longer allowed in x86-64 Linux?
(1 answer)
Closed 4 months ago.
I'm completing the final assignment for a compilers course and right now the deal is to translate some intermediate representation into x86_64 assembly source code and then build an executable through gcc by running
gcc output.s -o output
This executable should work properly. The issue is that I just can't get my code past GCC when it comes to (at least) one particular instruction. This is it:
mov L0, %rbx
Where L0 is a label.
The whole test file is as follows:
.text
.section .rodata
.text
.globl main
main:
// rbss for now
add $0, %rsp
mov %rsp, %rsi
// register spill area
add $0, %rsp
mov %rsp, %rdi
// store rax => rsp
mov %rax, %rcx
mov %rcx, ( %rsp )
// subI rsp, 4 => rsp
mov %rsp, %rcx
sub $4, %rcx
mov %rcx, %rsp
// lea L0 => rbx
mov L0, %rbx
// store rbp => rsp
mov %rbp, %rcx
mov %rcx, ( %rsp )
// subI rsp, 4 => rsp
mov %rsp, %rcx
sub $4, %rcx
mov %rcx, %rsp
// store rbx => rsp
mov %rbx, %rcx
mov %rcx, ( %rsp )
// subI rsp, 4 => rsp
mov %rsp, %rcx
sub $4, %rcx
mov %rcx, %rsp
// jumpI => Lmain
jmp Lmain
// L0 : halt
L0:
hlt
// Lmain : nop
Lmain:
// addI rsp, 0 => rbp
mov %rsp, %rcx
add $0, %rcx
mov %rcx, %rbp
// subI rsp, 0 => rsp
mov %rsp, %rcx
sub $0, %rcx
mov %rcx, %rsp
// addI rbp, 8 => rsp
mov %rbp, %rcx
add $8, %rcx
mov %rcx, %rsp
// loadAI rbp, 4 => rbp
mov %rdi, %rbx
add %rbp, %rbx
add $4, %rbx
mov ( %rbx ), %rcx
mov %rcx, %rbp
// jump => rbp
mov %rbp, %rbx
jmp *%rbx
Is there anything inherently mistaken about using mov this way? I'm not using call/ret semantics since the translation must be carried out directly from ILOC (a toy/education purpose) intermediate code.
When I try to run the aforementioned command I get some variation of:
/usr/bin/ld: /tmp/cccAoFmz.o: relocation R_X86_64_32S against `.text' can not be used when making a PIE object; recompile with -fPIE
collect2: error: ld returned 1 exit status
Could you guys help me to get a grasp of what's actually going on? I'm quite new to x86 programming and that's my first time with this kind of application. The whole assignment is done, my only issue is getting it to a working state (So no, huahuahua, I'm not getting you guys to do my homework :D).
Is there another way to get what I'm trying to achieve? Is my approach incorrect? I'm out of ideas right now.
Thank you so much :)
Best,

Correct usage of the RIP related addressing

I found example of code on assembly, which finds the maximum number in array named data_items but that example was for x86 and I tried to adapt it for x64 because 32 bit absolute addressing is not supported by 64 bit system.
To be short there are three actions:
lea data_items(%rip), %rdi #(1) Obtaining data_items address
add $4, %rdi #(2) Incrementing the pointer to 4 to read a next item
movl (%rdi), %eax #(3) Reading data at %rdi to %eax
The main questions:
Is it correct way to pointing? Can it produce error after code relocation?
If the %rip register constantly grows, why lea data_items(%rip), %rdi loads correct memory address? May be getting an offset by %rip have special meaning rather than "dataItems + %rip"?
Full adapted code here:
.section __DATA,__data
data_items:
.long 3,67,34,222,45,75,54,34,44,33,22,11,66,0
.section __TEXT,__text
.globl _main
_main:
lea data_items(%rip), %rdi #(1)
movl (%rdi), %eax
movl %eax, %ebx
start_loop:
cmpl $0, %eax
je loop_exit
add $4, %rdi #(2)
movl (%rdi), %eax #(3)
cmpl %ebx, %eax
jle start_loop
movl %eax, %ebx
jmp start_loop
loop_exit:
mov $0x2000001, %rax
mov $0, %rdi
syscall

Y86 Architecture Immediate VS Register Arithmetic Efficiency Question

I am working with a team in a Computer Architecture class on a Y86 program to implement multiplication function imul. We have a block of code that works, but we are trying to make it as execution-time efficient as we can. Currently our block looks like this for imul:
imul:
# push all used registers to stack for preservation
pushq %rdi
pushq %rsi
pushq %r8
pushq %r9
pushq %r10
irmovq 0, %r9 # set 0 into r9
rrmovq %rdi, %r10 # preserve rdi in r10
subq %rsi, %rdi # compare rdi and rsi
rrmovq %r10, %rdi # restore rdi
jl continue # if rdi (looping value/count) less than rsi, don't swap
swap:
# swap rsi and rdi to make rdi smaller value of the two
rrmovq %rsi, %rdi
rrmovq %r10, %rsi
continue:
subq %r9, %rdi # check if rdi is zero
cmove %r9, %rax # if rdi = 0, rax = 0
je imulDone # if rdi = 0, jump to end
irmovq 1, %r8 # set 1 into r8
rrmovq %rsi, %rax # set rax equal to initial value from rsi
imulLoop:
subq %r8, %rdi # count - 1
je imulDone # if count = 0, jump to end
addq %rsi, %rax # add another instance of rsi into rax, looped adition
jmp imulLoop # restart loop
imulDone:
# pop all used registers from stack to original values and return
popq %r10
popq %r9
popq %r8
popq %rsi
popq %rdi
ret
Right now our best idea is using immediate arithmetic instructions (isubq, etc) instead of normal OPq instructions with settings constants into registers and using those registers. Would this method be meaningfully more efficient in this particular instance? Thanks so much!

storage register for scanf call in gas

I am trying to understand scanf function a have 3 question regarding it.
this is c file:
#include <stdio.h>
#include <stdlib.h>
int main(){
int x;
printf("Enter X:\n");
scanf("%i",&x);
printf("You entered %d...\n",x);
return 0;
}
and here is gas:
.text
.section .rodata
.LC0:
.string "Enter X:"
.LC1:
.string "%i"
.LC2:
.string "You entered %d...\n"
.text
.globl main
.type main, #function
main:
pushq %rbp #
movq %rsp, %rbp #,
subq $16, %rsp #,
# a.c:5: printf("Enter X:\n");
leaq .LC0(%rip), %rdi #,
call puts#PLT #
# a.c:6: scanf("%i",&x);
leaq -4(%rbp), %rax #, tmp90
movq %rax, %rsi # tmp90,
leaq .LC1(%rip), %rdi #,
movl $0, %eax #,
call __isoc99_scanf#PLT #
# a.c:7: printf("You entered %d...\n",x);
movl -4(%rbp), %eax # x, x.0_1
movl %eax, %esi # x.0_1,
leaq .LC2(%rip), %rdi #,
movl $0, %eax #,
call printf#PLT #
# a.c:8: return 0;
movl $0, %eax #, _6
# a.c:9: }
leave
ret
.size main, .-main
.ident "GCC: (Debian 8.3.0-6) 8.3.0"
.section .note.GNU-stack,"",#progbits
1)
The rsi should take address of x int, but it takes the address from -4(%rbp), where there is nothing, in time of execution. Because the initialization of x variable comes from the stdin as scanf waits for input to init the variable. But the what is in -4(%rbp) in the time of instruction leaq -4(%rbp), %rax? It looks like garbage, not address of x, which value should be initialized from stdin.
2)according to this Integer describing number of floating point arguments in xmm registers not passed to rax, the movl $0, %eax is to zero FP registers in al, but that is the same convention for printf. So my question is, to which functions from glibc or other libraries apply this convetion? (So I have to zero %al in printf, scanf, ....?). I assume to every, that has va_list or variable argument?
3) where in the gas source is stack canary in that should protect scanf buffer from overflow? according to this: https://reverseengineering.stackexchange.com/questions/10823/how-does-scanf-interact-with-my-code-in-assembly, this should set canary (in masm):
0x080484c5 <+6>: mov eax,gs:0x14
0x080484cb <+12>: mov DWORD PTR [ebp-0xc],eax
0x080484ce <+15>: xor eax,eax
But I see nothing similar to this in my gas source, which is also output from gcc, which should set it by itself (unless there is some checking in the the scanf function itself which is not visible in my source). So where is it?

problem performing recursive call in quick sort assembly

I'm having a problem implementing quicksort in assembly, when I'm trying to perform the second recursive call to qsort(arr,pi+1,high) I don't know why, but it exits the recursion too early.
I've tried using the stack and writing helper functions, but everything I've tied created new problems. When debbuging, I see that I exit the function when %ebx = 4 and %ecx = 5 and the array is almost sorted array ={10,30,40,50,70,90,80} - I need only to perform the last swap when %ebx = 5 and %ecx = 6, but it exits before, and I don't understand why it won't go back to when %ecx was 6.
I thought perhaps the problem is when I'm making the comparisons between high and low, but If I change those, I'm having different problems (it exists too early the first recursive call). perhaps anyone has an idea what's wrong with my code?
here's my code:
.data
array: .int 10, 80, 30, 90, 40, 50, 70
size: .int 7
.text
.global main
main:
movl $0, %ebx # low index
movl (size), %ecx # high index
dec %ecx # ecx = size -1
qsort:
cmp %ecx, %ebx # high > low
jge end
movsx %ecx, %r13 # push high
movsx %ebx, %r12 # push low
call partition # rax now is the pivot
movq %r12, %rbx # pop low
movl %eax, %ecx # prepare new high = pi
subl $1, %ecx # high = pi-1
call qsort # qsort(arr,low,pi-1)
movl %eax,%ebx # push new low = pi+1
inc %ebx
call qsort # qsort(arr,pi+1,high)
ret
partition:
movq %r12, %rax # get low
movq %r13, %rbx # get high
movl %eax, %ecx # j = low
subl $1, %eax # i = low-1
movl array(,%ebx,4), %edx # pivot = array[high]
swap_loop:
cmp %ebx, %ecx # high > j
jge swap_greater
movl array(,%ecx,4), %esi # esi = array[j]
cmp %edx, %esi # pivot > array[j] ?
jge loops # jmp if array[j] > pivot
inc %eax # i++
# swap
movsx %esi, %rsi
pushq %rsi
movl array(,%eax,4), %edi # edi = array[i]
movl %edi, array(,%ecx,4) # array[j]=array[i]
pop %rsi
movl %esi, array(,%eax,4) # array[i]= previous array[j]
loops:
inc %ecx # j++
jmp swap_loop
swap_greater:
inc %eax
movsx %edx, %rdx
pushq %rdx
movl array(,%eax,4), %edi # edi = array[i+1]
movl %edi, array(,%ebx,4) # array[high]=array[i+1]
pop %rdx
movl %edx, array(,%eax,4) # array[i+1]= previous array[high]
dec %eax
end_p:
inc %eax
ret
end:
inc %ecx
movsx %ecx, %r13 # update high
ret
edit: as Peter Cordes has pointed out - I need to work with the stack in order to retrieve the parameters when I go back from the recursive calls. after re-writing my code using the stack, I have a new problem, I always pop out the same thing on the second recursive call. I don't understand why it doesn't do the "recursive folding" like in C, when I look at the stack there's something weird, since I'm not seeing the values as I excpect ( I excpect to see layers or rax-high-low-rax-high-low...etc) but instead there are those numbers:
native process 42032 In: second_rec L?? PC: 0x4005ea
0x7fffffffdeb0: 0x0000000000000000 0x0000000000000001
0x7fffffffdec0: 0x0000000000000002 0x00000000004005ef
0x7fffffffded0: 0x0000000000000000 0x0000000000000002
0x7fffffffdee0: 0x0000000000000001 0x00000000004005df
0x7fffffffdef0: 0x0000000000000000 0x0000000000000001
0x7fffffffdf00: 0x0000000000000002 0x00000000004005df
0x7fffffffdf10: 0x0000000000000000 0x0000000000000002
0x7fffffffdf20: 0x0000000000000003 0x00000000004005df
0x7fffffffdf30: 0x0000000000000000 0x0000000000000003
0x7fffffffdf40: 0x0000000000000004 0x00007ffff7a05b97
0x7fffffffdf50: 0x0000000000000001 0x00007fffffffe028
0x7fffffffdf60: 0x0000000100008000 0x00000000004005a7
perhaps I'm not pushing\popping in the right timing, but from what I've understood, I'm pushing parameters before call, and popping them when I return from the call... does anyone have an idea what am I doing wrong? the new code:
.data
array: .int 10, 80, 30, 90, 40, 50, 70
size: .int 7
.text
.global main
main:
movl $0, %ebx # low index
movl (size), %ecx # high index
dec %ecx # ecx = size -1
qsort:
cmp %ecx, %ebx # high > low
jge end
movsx %ecx, %rcx # prepare high
movsx %ebx, %rbx # prepare low
pushq %rcx # push high
pushq %rbx # push low
call partition # rax now is the pivot
popq %rbx # pop low
popq %rcx # pop high
movsx %eax, %rax
pushq %rax # push pivot
movl %eax, %ecx # prepare new high = pi
subl $1, %ecx # pi-=1
movsx %ecx, %rcx
pushq %rcx # push high
pushq %rbx # push low
call qsort # qsort(arr,low,pi-1)
second_rec:
popq %rbx # pop low
popq %rcx # pop high
popq %rax # pop pivot
movl %eax, %ecx # high = pi
addl $1, %ecx # high = pi+1
pushq %rax # push pivot
pushq %rcx # push high
pushq %rbx # push low
call qsort # qsort(arr,pi+1,high)
addq $24, %rsp
ret
partition:
movq 8(%rsp), %rax # get low
movq 16(%rsp), %rbx # get high
movl %eax, %ecx # j = low
subl $1, %eax # i = low-1
movl array(,%ebx,4), %edx # pivot = array[high]
swap_loop:
cmp %ebx, %ecx # high > j
jge swap_greater
movl array(,%ecx,4), %esi # esi = array[j]
cmp %edx, %esi # pivot > array[j] ?
jge loops # jmp if array[j] > pivot
inc %eax # i++
# swap
movsx %esi, %rsi
pushq %rsi
movl array(,%eax,4), %edi # edi = array[i]
movl %edi, array(,%ecx,4) # array[j]=array[i]
pop %rsi
movl %esi, array(,%eax,4) # array[i]= previous array[j]
loops:
inc %ecx # j++
jmp swap_loop
swap_greater:
inc %eax
movsx %edx, %rdx
pushq %rdx
movl array(,%eax,4), %edi # edi = array[i+1]
movl %edi, array(,%ebx,4) # array[high]=array[i+1]
pop %rdx
movl %edx, array(,%eax,4) # array[i+1]= previous array[high]
dec %eax
end_p:
inc %eax
ret
end:
ret
Thank you very much everyone for your help!

Resources