1 / 33

networkworld/news/2006/100606-hackers-find-use-for-google.html

Computer Organization and Design Lecture 12 – Running a Program II aka Compiling, Assembling, Linking, Loading. www.google.com/codesearch.

katy
Download Presentation

networkworld/news/2006/100606-hackers-find-use-for-google.html

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Computer Organization and DesignLecture 12 – Running a Program IIaka Compiling, Assembling, Linking, Loading www.google.com/codesearch Security hole finderGoogle’s just-released new/* Code Search */, which allows you to specify regular expressions to search public source code, also allows hackers to easily find known loopholes! Yikes! www.networkworld.com/news/2006/100606-hackers-find-use-for-google.html

  2. Compiler Assembly program: foo.s Assembler Object(mach lang module): foo.o Linker lib.o Executable(mach lang pgm): a.out Loader Memory Review C program: foo.c

  3. 目标文件格式 • 目标文件头: 定义目标文件中其他部分大小和位置 • 代码段: 机器码 • 数据段: 源文件中数据的二进制表示 • 重定位信息: 需要处理的代码中的标识 • 符号表: 列出文件中可以被引用的标号和数据 • 调试信息 • A standard format is ELF (except MS) http://www.skyfree.org/linux/references/ELF_Format.pdf

  4. lib.o Where Are We Now? C program: foo.c Compiler Assembly program: foo.s Assembler Object(mach lang module): foo.o Linker Executable(mach lang pgm): a.out Loader Memory

  5. 链接Linker (1/3) • 输入: 目标代码文件, 信息表 (e.g., foo.o,libc.o for MIPS) • 输出: 执行代码(e.g., a.out for MIPS) • 将几个目标 (.o)文件链接成一个执行文件 (“linking”) • 使分离编译成为可能 • 修改一个文件，不必编译整个程序 • Windows NT source is >40 M lines of code! • 原来的名字 “Link Editor”：源于编辑跳转语句的“链接”及链接指令

  6. Linker (2/3) .o file 1 text 1 a.out data 1 Relocated text 1 info 1 Relocated text 2 Linker Relocated data 1 .o file 2 text 2 Relocated data 2 data 2 info 2

  7. Linker (3/3) • Step 1: 从每个.o文件中取出代码段放在一起. • Step 2: 从每个.o文件中取出数据段放在一起, 并把结果连接到代码段的尾部. • Step 3: 确定地址 • 查找重定位表，处理每项 • 即, 填充所有绝对地址

  8. 四种主要寻址方式 • PC-Relative寻址 (beq, bne): 从不重定位 • 绝对寻址 (j, jal): 总是重定位 • 外部寻址 (通常是jal):总是重定位 • 数据寻址 (通常是lui和ori):总是重定位

  9. j/jal xxxxx • Loads and stores to variables in static area, relative to global pointer beq/bne lw/sw $gp $rs $rt $x address address • 条件分支语句情况如何? MIPS中的绝对寻址 • 哪些指令需要重定位编辑? • J-format: jump, jump and link • PC-相对寻址，代码移动后地址仍不变

  10. 确定地址 (1/2) • 链接器认为第一个代码段的第一个字所在地址为 0x00000000. (在学习“虚拟内存”时会进一步讨论) • 链接器知道: • 每个文件的代码段和数据段的长度 • 代码段和数据段的顺序 • 链接器计算: • 每个要跳转到的标记的绝对地址 (内部或者外部) 及每个要访问的数据的地址

  11. 确定地址 (2/2) • 确定地址: • 在“用户”自己的所有符号表中查找地址(数据或标号) • 如果没有找到,查找库文件 (如printf) • 一旦绝对地址确定了,在机器码中填写相应内容 • 链接器的输出: 执行文件包括代码和数据 (另外还有头)

  12. 静态 vs 动态链接库 • 我们所描述的是传统的“静态链接” 方式 • 现在库文件是执行文件的一部分, 因此，如果库文件更新了, 我们并没更新 (如果我们有原程序，可以重新编译一次) • 执行文件中包含整个库，尽管我们不使用所有的. • 执行文件是完整的. • 另一种方案是动态链接库(DLL),常见于Windows和UNIX中

  13. 动态链接库 en.wikipedia.org/wiki/Dynamic_linking This does add quite a bit of complexity to the compiler, linker, and operating system. However, it provides many benefits: • 时/空问题 • + 存储程序所需要的空间更少 • + 发送程序所需时间更少 • + 执行两个程序需要更少内存 (如果共享一个库) • – 在运行时, 进行链接会产生延时 • 升级 • + 更新一个文件 (libXYZ.so)就可升级所有使用库 “XYZ”的文件 • – 拥有执行文件是不够的

  14. 动态链接库 • 动态链接的最大好处是使用 “最少公共代码” • 链接器不使用有关程序或库编译方式的信息 (即不管用的什么编译器或者语言) • 这可以描述为 “在机器语言级进行链接” • 这不是唯一的方式...

  15. lib.o Where Are We Now? C program: foo.c Compiler Assembly program: foo.s Assembler Object(mach lang module): foo.o Linker Executable(mach lang pgm): a.out Loader Memory

  16. Loader (1/3) • 输入: 执行程序(如MIPS的a.out) • 输出: (正在运行的程序) • 执行程序存储在磁盘上. • 当需要运行时, 装入器（loader）的任务就是将程序装入内存中并开始运行. • 在现实中, 装入器包含在操作系统中 (OS) • 装入（loading）是操作系统的一个任务

  17. Loader (2/3) • 装入器做些什么呢? • 读入执行文件头，以确定代码段和数据段的大小 • 为程序创建足够的地址空间，以容纳代码段、数据段和堆栈段。 • 从执行文件中复制指令和数据到新创建的地址空间 • 将传入程序的运行参数复制到栈 • 初始化机器寄存器 • 清除大多数寄存, 对栈指针指定栈中第一个空余地址

  18. Loader (3/3) • 跳转到程序的开始位置，从这里开始将程序的运行参数从栈复制到寄存器，并设置PC • 当main返回时, 启动（start-up）例程用exit系统调用终止程序

  19. Big Endian ADDR3 ADDR2 ADDR1 ADDR0BYTE0BYTE1BYTE2BYTE300000001000001000000000000000000 ADDR0 ADDR1 ADDR2 ADDR3BYTE3BYTE2BYTE1BYTE000000000000000000000010000000001 Little Endian ADDR3 ADDR2 ADDR1 ADDR0BYTE3BYTE2BYTE1BYTE000000000000000000000010000000001 ADDR0 ADDR1 ADDR2 ADDR3BYTE0BYTE1BYTE2BYTE300000001000001000000000000000000 Big Endian vs. Little Endian Big-endian and little-endian derive from Jonathan Swift's Gulliver's Travels in which the Big Endians were a political faction that broke their eggs at the large end ("the primitive way") and rebelled against the Lilliputian King who required his subjects (the Little Endians) to break their eggs at the small end. • The order in which BYTES are stored in memory • Bits always stored as usual. (E.g., 0xC2=0b 1100 0010) Consider the number 1025 as we normally write it:BYTE3 BYTE2BYTE1BYTE000000000000000000000010000000001 www.webopedia.com/TERM/b/big_endian.htmlsearchnetworking.techtarget.com/sDefinition/0,,sid7_gci211659,00.html www.noveltheory.com/TechPapers/endian.asp en.wikipedia.org/wiki/Big_endian

  20. Example: C Asm  Obj  Exe  Run C Program Source Code: prog.c #include <stdio.h> int main (int argc, char *argv[]) { int i, sum = 0; for (i = 0; i <= 100; i++) sum = sum + i * i; printf ("The sum from 0 .. 100 is %d\n", sum); } “printf” lives in “libc”

  21. .text .align 2 .globl main main: subu $sp,$sp,32 sw $ra, 20($sp) sd $a0, 32($sp) sw $0, 24($sp) sw $0, 28($sp) loop: lw $t6, 28($sp) mul $t7, $t6,$t6 lw $t8, 24($sp) addu $t9,$t8,$t7 sw $t9, 24($sp) addu $t0, $t6, 1 sw $t0, 28($sp) ble $t0,100, loop la $a0, str lw $a1, 24($sp) jal printf move $v0, $0 lw $ra, 20($sp) addiu $sp,$sp,32 jr $ra .data .align 0 str: .asciiz "The sum from 0 .. 100 is %d\n" Compilation: MAL Where are 7 pseudo-instructions?

  22. .text .align 2 .globl main main: subu $sp,$sp,32 sw $ra, 20($sp) sd $a0, 32($sp) sw $0, 24($sp) sw $0, 28($sp) loop: lw $t6, 28($sp) mul $t7, $t6,$t6 lw $t8, 24($sp) addu $t9,$t8,$t7 sw $t9, 24($sp) addu $t0, $t6, 1 sw $t0, 28($sp) ble $t0,100, loop la $a0, str lw $a1, 24($sp) jal printf move $v0, $0 lw $ra, 20($sp) addiu $sp,$sp,32 jr $ra .data .align 0 str: .asciiz "The sum from 0 .. 100 is %d\n" Compilation: MAL 7 pseudo-instructionsunderlined

  23. 00 addiu $29,$29,-32 04 sw $31,20($29) 08 sw $4, 32($29) 0c sw $5, 36($29) 10 sw $0, 24($29) 14 sw $0, 28($29) 18 lw $14, 28($29) 1c multu $14, $14 20 mflo $15 24 lw $24, 24($29) 28 addu $25,$24,$15 2c sw $25, 24($29) 30 addiu $8,$14, 1 34 sw $8,28($29) 38 slti $1,$8, 101 3c bne $1,$0, loop 40 lui $4, l.str 44 ori $4,$4,r.str 48 lw $5,24($29) 4c jal printf 50 add $2, $0, $0 54 lw $31,20($29) 58 addiu $29,$29,32 5c jr $31 Assembly step 1: • Remove pseudoinstructions, assign addresses

  24. Assembly step 2 • Create relocation table and symbol table • Symbol Table Label address (in module) type main: 0x00000000 global text loop: 0x00000018 local text str: 0x00000000 local data • Relocation Information Address Instr. type Dependency0x00000040 lui l.str0x00000044 ori r.str 0x0000004c jal printf

  25. 00 addiu $29,$29,-32 04 sw $31,20($29) 08 sw $4, 32($29) 0c sw $5, 36($29) 10 sw $0, 24($29) 14 sw $0, 28($29) 18 lw $14, 28($29) 1c multu $14, $14 20 mflo $15 24 lw $24, 24($29) 28 addu $25,$24,$15 2c sw $25, 24($29) 30 addiu $8,$14, 1 34 sw $8,28($29) 38 slti $1,$8, 101 3c bne $1,$0, -10 40 lui $4, l.str 44 ori $4,$4,r.str 48 lw $5,24($29) 4c jal printf 50 add $2, $0, $0 54 lw $31,20($29) 58 addiu $29,$29,32 5c jr $31 Assembly step 3 • Resolve local PC-relative labels

  26. Assembly step 4 • 生成目标(.o)文件: • 输出二进制表示 • 代码段 (instructions), • 数据段 (data), • 符号表和重定位表. • 对于未确定的绝对地址和外部地址，预留位置（置０）.

  27. Text segment in object file 0x000000 00100111101111011111111111100000 0x000004 10101111101111110000000000010100 0x000008 10101111101001000000000000100000 0x00000c 10101111101001010000000000100100 0x000010 10101111101000000000000000011000 0x000014 10101111101000000000000000011100 0x000018 10001111101011100000000000011100 0x00001c 10001111101110000000000000011000 0x000020 00000001110011100000000000011001 0x000024 00100101110010000000000000000001 0x000028 00101001000000010000000001100101 0x00002c 10101111101010000000000000011100 0x000030 00000000000000000111100000010010 0x000034 00000011000011111100100000100001 0x000038 00010100001000001111111111110111 0x00003c 10101111101110010000000000011000 0x000040 00111100000001000000000000000000 0x000044 10001111101001010000000000000000 0x000048 00001100000100000000000011101100 0x00004c 00100100000000000000000000000000 0x000050 10001111101111110000000000010100 0x000054 00100111101111010000000000100000 0x000058 00000011111000000000000000001000 0x00005c 00000000000000000001000000100001

  28. Link step 1: combine prog.o, libc.o • 融合代码/数据段 • 生成绝对内存地址 • 修改并融合符号表和重定位表 • 符号表 • Label Address main: 0x00000000 loop: 0x00000018 str: 0x10000430 printf: 0x00000cb0 … • 重定位表信息 • Address Instr. Type Dependency 0x00000040 lui l.str0x00000044 ori r.str 0x0000004c jal printf …

  29. 00 addiu $29,$29,-32 04 sw $31,20($29) 08 sw $4, 32($29) 0c sw $5, 36($29) 10 sw $0, 24($29) 14 sw $0, 28($29) 18 lw $14, 28($29) 1c multu $14, $14 20 mflo $15 24 lw $24, 24($29) 28 addu $25,$24,$15 2c sw $25, 24($29) 30 addiu $8,$14, 1 34 sw $8,28($29) 38 slti $1,$8, 101 3c bne $1,$0, -10 40 lui $4, 4096 44 ori $4,$4,1072 48 lw $5,24($29) 4c jal 812 50 add $2, $0, $0 54 lw $31,20($29) 58 addiu $29,$29,32 5c jr $31 Link step 2: • Edit Addresses in relocation table • (shown in TAL for clarity, but done in binary )

  30. 输出融合模块后的执行文件. 单个代码段 (instruction) 单个数据段 头中包含每个段的大小 注: 前面例子是ELF和其他标准格式如何运作的一个极端简化的版本，仅仅是为了展示基本原理. Link step 3:

  31. C program: foo.c Compiler Assembly program: foo.s Assembler Object(mach lang module): foo.o Linker lib.o Executable(mach lang pgm): a.out Loader Memory Things to Remember (1/3)

  32. Things to Remember (2/3) • 编译器将一个高级语言程序转换成单个汇编语言文件. • 汇编器移动伪指令, 尽其所能地转换为机器语言, 为链接器生成一张检查表 (重定位表). 将.s文件转换成.o文件. • 使用两次扫描解析地址，处理内部向前寻址 • 链接器将多个.o文件组合在一起，并确定绝对地址 • 使分离编译成为可能, 库函数不必编译, 确定余下的地址 • 装入器将执行程序装入到内存中，并开始执行.

  33. Things to Remember 3/3 • 存储程序的概念是非常强大的. 它意味着指令有时可以象数据一样处理. 这样，就可以用程序来处理其他程序! Compiler  Assembler  Linker ( Loader )

More Related