Homework 3 - Stack Overflow

FAQ

Updated: Apr 7, 2010

System call numbers

As you should be able to tell from the disassembled code for server, the SYSCALL instruction works pretty much just like a regular function call. The only difference is that before invoking, $v0 must contain a numeric code for which operating system service should be invoked: 1 for "printi", 2 for "prints", 3 for "putc", and so on. These numeric codes are not standard, but are specific to the cs3410 simulator. Other simulators you might find on the web will use their own numeric codes.

Compiling and running your own code

If you want to write your own C program to run in the simulator, you can use mipsel-linux-gcc to compile it. In the /courses/cs3410/sim directory we have placed:

We want the newline (Updated: April 6)

Getting the server to print your message is the primary goal of this assignment, and will earn the bulk of the credit. But for full credit, your exploit we want the newline to print as well. As you may have discovered, you can't simply embed a newline or carriage return in the message, because the server stops reading when it encounters these characters. Something more clever is called for.

Stack layout depends on command line (Updated: April 7)

Standard convention is for main(int argc, char **argv) to be invoked with the name of the program itself as argv[0]. In order to support this, the simulator pushes the name of the MIPS program file on to the stack before invoking main. You may have noticed this file name appears near the top of the stack.

Important: An unfortunate consequence is that the stack alignment of main and all other functions depends on how you invoke the program. There are ways to avoid this.

Option 1: Always be sure to invoke the simulator using the exact same file name argument for the server file. In other words, whatever you are using as the last argument to the simulate program, you should always use as the last argument.

So if you invoke the simulator like this:

 $ simulate ./server

Then any of these is acceptable as well, and will not change the stack alignment:

 $ /courses/cs3410/sim/bin/simulate ./server
 $ simulate -d ./server
 $ /courses/cs3410/sim/bin/simulate -d -i exploit.binary ./server
 $ cat exploit.txt | xxd -r | simulate ./server

But any of these will cause the stack to have a different alignment:

 $ simulate server
 $ simulate /courses/cs3410/hw3/server
 $ simulate ~/server
 $ simulate hw3/server

Option 2: I added a "-noargs" option to the simulator which will always invoke main with some constant empty arguments regardless of what you write on the command line. Using the "-noargs" option, you can invoke simulator any way you like and it will always use the same stack layout:

 $ simulate -noargs server
 $ simulate -noargs ./server
 $ simulate -noargs ~/server
 $ simulate -noargs /courses/cs3410/hw3/server

Although this is how real programs do work, I apologize for this extra wrinkle in the assignment. I don't want to change the default behavior of simulate at this point since many students have already started the assignment.