linux下system函數(shù)的簡單分析
簡單分析了linux下system函數(shù)的相關(guān)內(nèi)容,具體內(nèi)容如下
int
__libc_system (const char *line)
{
if (line == NULL)
/* Check that we have a command processor available. It might
not be available after a chroot(), for example. */
return do_system ("exit 0") == 0;
return do_system (line);
}
weak_alias (__libc_system, system)
代碼位于glibc/sysdeps/posix/system.c,這里system是__libc_system的弱別名,而__libc_system是do_system的前端函數(shù),進(jìn)行了參數(shù)的檢查,接下來看do_system函數(shù)。
static int
do_system (const char *line)
{
int status, save;
pid_t pid;
struct sigaction sa;
#ifndef _LIBC_REENTRANT
struct sigaction intr, quit;
#endif
sigset_t omask;
sa.sa_handler = SIG_IGN;
sa.sa_flags = 0;
__sigemptyset (&sa.sa_mask);
DO_LOCK ();
if (ADD_REF () == 0)
{
if (__sigaction (SIGINT, &sa, &intr) < 0)
{
(void) SUB_REF ();
goto out;
}
if (__sigaction (SIGQUIT, &sa, &quit) < 0)
{
save = errno;
(void) SUB_REF ();
goto out_restore_sigint;
}
}
DO_UNLOCK ();
/* We reuse the bitmap in the 'sa' structure. */
__sigaddset (&sa.sa_mask, SIGCHLD);
save = errno;
if (__sigprocmask (SIG_BLOCK, &sa.sa_mask, &omask) < 0)
{
#ifndef _LIBC
if (errno == ENOSYS)
__set_errno (save);
else
#endif
{
DO_LOCK ();
if (SUB_REF () == 0)
{
save = errno;
(void) __sigaction (SIGQUIT, &quit, (struct sigaction *) NULL);
out_restore_sigint:
(void) __sigaction (SIGINT, &intr, (struct sigaction *) NULL);
__set_errno (save);
}
out:
DO_UNLOCK ();
return -1;
}
}
#ifdef CLEANUP_HANDLER
CLEANUP_HANDLER;
#endif
#ifdef FORK
pid = FORK ();
#else
pid = __fork ();
#endif
if (pid == (pid_t) 0)
{
/* Child side. */
const char *new_argv[4];
new_argv[0] = SHELL_NAME;
new_argv[1] = "-c";
new_argv[2] = line;
new_argv[3] = NULL;
/* Restore the signals. */
(void) __sigaction (SIGINT, &intr, (struct sigaction *) NULL);
(void) __sigaction (SIGQUIT, &quit, (struct sigaction *) NULL);
(void) __sigprocmask (SIG_SETMASK, &omask, (sigset_t *) NULL);
INIT_LOCK ();
/* Exec the shell. */
(void) __execve (SHELL_PATH, (char *const *) new_argv, __environ);
_exit (127);
}
else if (pid < (pid_t) 0)
/* The fork failed. */
status = -1;
else
/* Parent side. */
{
/* Note the system() is a cancellation point. But since we call
waitpid() which itself is a cancellation point we do not
have to do anything here. */
if (TEMP_FAILURE_RETRY (__waitpid (pid, &status, 0)) != pid)
status = -1;
}
#ifdef CLEANUP_HANDLER
CLEANUP_RESET;
#endif
save = errno;
DO_LOCK ();
if ((SUB_REF () == 0
&& (__sigaction (SIGINT, &intr, (struct sigaction *) NULL)
| __sigaction (SIGQUIT, &quit, (struct sigaction *) NULL)) != 0)
|| __sigprocmask (SIG_SETMASK, &omask, (sigset_t *) NULL) != 0)
{
#ifndef _LIBC
/* glibc cannot be used on systems without waitpid. */
if (errno == ENOSYS)
__set_errno (save);
else
#endif
status = -1;
}
DO_UNLOCK ();
return status;
}
do_system
首先函數(shù)設(shè)置了一些信號處理程序,來處理SIGINT和SIGQUIT信號,此處我們不過多關(guān)心,關(guān)鍵代碼段在這里
#ifdef FORK
pid = FORK ();
#else
pid = __fork ();
#endif
if (pid == (pid_t) 0)
{
/* Child side. */
const char *new_argv[4];
new_argv[0] = SHELL_NAME;
new_argv[1] = "-c";
new_argv[2] = line;
new_argv[3] = NULL;
/* Restore the signals. */
(void) __sigaction (SIGINT, &intr, (struct sigaction *) NULL);
(void) __sigaction (SIGQUIT, &quit, (struct sigaction *) NULL);
(void) __sigprocmask (SIG_SETMASK, &omask, (sigset_t *) NULL);
INIT_LOCK ();
/* Exec the shell. */
(void) __execve (SHELL_PATH, (char *const *) new_argv, __environ);
_exit (127);
}
else if (pid < (pid_t) 0)
/* The fork failed. */
status = -1;
else
/* Parent side. */
{
/* Note the system() is a cancellation point. But since we call
waitpid() which itself is a cancellation point we do not
have to do anything here. */
if (TEMP_FAILURE_RETRY (__waitpid (pid, &status, 0)) != pid)
status = -1;
}
首先通過前端函數(shù)調(diào)用系統(tǒng)調(diào)用fork產(chǎn)生一個(gè)子進(jìn)程,其中fork有兩個(gè)返回值,對父進(jìn)程返回子進(jìn)程的pid,對子進(jìn)程返回0。所以子進(jìn)程執(zhí)行6-24行代碼,父進(jìn)程執(zhí)行30-35行代碼。
子進(jìn)程的邏輯非常清晰,調(diào)用execve執(zhí)行SHELL_PATH指定的程序,參數(shù)通過new_argv傳遞,環(huán)境變量為全局變量__environ。
其中SHELL_PATH和SHELL_NAME定義如下
#define SHELL_PATH "/bin/sh" /* Path of the shell. */ #define SHELL_NAME "sh" /* Name to give it. */
其實(shí)就是生成一個(gè)子進(jìn)程調(diào)用/bin/sh -c "命令"來執(zhí)行向system傳入的命令。
下面其實(shí)是我研究system函數(shù)的原因與重點(diǎn):
在CTF的pwn題中,通過棧溢出調(diào)用system函數(shù)有時(shí)會失敗,聽師傅們說是環(huán)境變量被覆蓋,但是一直都是懵懂,今天深入學(xué)習(xí)了一下,總算搞明白了。
在這里system函數(shù)需要的環(huán)境變量儲存在全局變量__environ中,那么這個(gè)變量的內(nèi)容是什么呢。
__environ是在glibc/csu/libc-start.c中定義的,我們來看幾個(gè)關(guān)鍵語句。
# define LIBC_START_MAIN __libc_start_main
__libc_start_main是_start調(diào)用的函數(shù),這涉及到程序開始時(shí)的一些初始化工作,對這些名詞不了解的話可以看一下這篇文章。接下來看LIBC_START_MAIN函數(shù)。
STATIC int
LIBC_START_MAIN (int (*main) (int, char **, char ** MAIN_AUXVEC_DECL),
int argc, char **argv,
#ifdef LIBC_START_MAIN_AUXVEC_ARG
ElfW(auxv_t) *auxvec,
#endif
__typeof (main) init,
void (*fini) (void),
void (*rtld_fini) (void), void *stack_end)
{
/* Result of the 'main' function. */
int result;
__libc_multiple_libcs = &_dl_starting_up && !_dl_starting_up;
#ifndef SHARED
char **ev = &argv[argc + 1];
__environ = ev;
/* Store the lowest stack address. This is done in ld.so if this is
the code for the DSO. */
__libc_stack_end = stack_end;
......
/* Nothing fancy, just call the function. */
result = main (argc, argv, __environ MAIN_AUXVEC_PARAM);
#endif
exit (result);
}
我們可以看到,在沒有define SHARED的情況下,在第19行定義了__environ的值。啟動(dòng)程序調(diào)用LIBC_START_MAIN之前,會先將環(huán)境變量和argv中的字符串保存起來(其實(shí)是保存到棧上),然后依次將環(huán)境變量中各項(xiàng)字符串的地址,argv中各項(xiàng)字符串的地址和argc入棧,所以環(huán)境變量數(shù)組一定位于argv數(shù)組的正后方,以一個(gè)空地址間隔。所以第17行的&argv[argc + 1]語句就是取環(huán)境變量數(shù)組在棧上的首地址,保存到ev中,最終保存到__environ中。第203行調(diào)用main函數(shù),會將__environ的值入棧,這個(gè)被棧溢出覆蓋掉沒什么問題,只要保證__environ中的地址處不被覆蓋即可。
所以,當(dāng)棧溢出的長度過大,溢出的內(nèi)容覆蓋了__environ中地址中的重要內(nèi)容時(shí),調(diào)用system函數(shù)就會失敗。具體環(huán)境變量距離溢出地址有多遠(yuǎn),可以通過在_start中下斷查看。
以上就是本文的全部內(nèi)容,希望對大家的學(xué)習(xí)有所幫助,也希望大家多多支持本站。
版權(quán)聲明:本站文章來源標(biāo)注為YINGSOO的內(nèi)容版權(quán)均為本站所有,歡迎引用、轉(zhuǎn)載,請保持原文完整并注明來源及原文鏈接。禁止復(fù)制或仿造本網(wǎng)站,禁止在非maisonbaluchon.cn所屬的服務(wù)器上建立鏡像,否則將依法追究法律責(zé)任。本站部分內(nèi)容來源于網(wǎng)友推薦、互聯(lián)網(wǎng)收集整理而來,僅供學(xué)習(xí)參考,不代表本站立場,如有內(nèi)容涉嫌侵權(quán),請聯(lián)系alex-e#qq.com處理。
關(guān)注官方微信