Rozdíly

Zde můžete vidět rozdíly mezi vybranou verzí a aktuální verzí dané stránky.

--- umeni_exploitace [2012/02/18 20:16] – vytvořeno djbuldog
+++ umeni_exploitace [2025/08/28 10:09] (aktuální) – upraveno mimo DokuWiki 127.0.0.1
@@ Řádek 80: / Řádek 80: @@
 gs             0x0      0
 </code>
+===== Co rika segfault =====
+  * tohle jsem nevedel :) je to velice zajimave :)
+<code>
+[1000950.117170] nfprofile[19184]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fffed2781c0 error 4 in nfprofile[400000+25000]
+[1000950.120928] nfprofile[19185]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff2d003080 error 4 in nfprofile[400000+25000]
+[1000950.124587] nfprofile[19186]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fffedda2e90 error 4 in nfprofile[400000+25000]
+[1005919.114319] nfprofile[32626]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff8871a070 error 4 in nfprofile[400000+25000]
+[1022741.303483] nfprofile[11309]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff5baf7ec0 error 4 in nfprofile[400000+25000]
+[1185433.766166] nfprofile[22225]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff96a5eae0 error 4 in nfprofile[400000+25000]
+[1185433.770096] nfprofile[22226]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff3c799510 error 4 in nfprofile[400000+25000]
+[1185433.773886] nfprofile[22227]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fffb9240610 error 4 in nfprofile[400000+25000]
+[1186145.925757] nfprofile[24369]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff0fa10cf0 error 4 in nfprofile[400000+25000]
+[1191930.527903] nfprofile[9294]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff59045820 error 4 in nfprofile[400000+25000]
+objdump -NCl on the nfprofile binary tells me 402c67 in the compiled application is in process_data() at line 130
+: nffile = GetNextFile(NULL, 0, 0);
+: if ( !nffile ) {
+: LogError("GetNextFile() error in %s line %d: %s\n", __FILE__, __LINE__, strerror(errno) );
+: return;
+: }
+:
+: // store infos away for later use
+: // although multiple files may be processed, it is assumed that all
+: // have the same settings
+: is_anonymized = IP_ANONYMIZED(nffile);
+: strncpy(Ident, nffile->file_header->ident, IDENTLEN);
+: Ident[IDENTLEN-1] = '\0';
+</code>
+  * a prakticky to bude takove...
+<code>
+nfprofile[3448]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff025f6830 error 4
+nfprofile[3454]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff4a5dac60 error 4 in nfprofile[400000+22000] in nfprofile[400000+22000]
+nfprofile[3446]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff4b56d150 error 4 in nfprofile[400000+22000]
+nfprofile[3458]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff7a1d4dd0 error 4 in nfprofile[400000+22000]
+nfprofile[3456]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff20e5a570 error 4 in nfprofile[400000+22000]
+nfprofile[3450]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff58e734f0 error 4 in nfprofile[400000+22000]
+nfprofile[3452]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff3c90aa20 error 4 in nfprofile[400000+22000]
+</code>
+<code>
+$ objdump -DCl /usr/local/bin/nfprofile  | less
+..
+/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:626
+:       48 89 44 24 68          mov    %rax,0x68(%rsp)
+process_data():
+/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:121
+c:       e8 cf bd 00 00          callq  40e500 <GetNextFile>
+/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:122
+:       48 85 c0                test   %rax,%rax
+/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:121
+:       49 89 c7                mov    %rax,%r15
+/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:122
+:       0f 84 89 0f 00 00       je     4036c6 <main+0x1566>
+..
+</code>
+===== ladeni segmentation fault (segfault) 2 =====
+  * zdroje: http://mytechrants.wordpress.com/2009/05/22/debugging-a-segmentation-fault-using-gdb/
+  * priiklad z praxe
+  * klasicky vystup pri spusteni programu
+<code>
+/home/bari/Plocha/flowmon-vyvoj/nfdump-1.6.9-nbar-lic3.0-geo-http/bin/sfcapd -E -w -p 3030  -l /tmp/
+..
+Neoprávněný přístup do paměti (SIGSEGV)
+</code>
+  * v dmesg se dozvime vice, ale je to k nicemu. Program umrel pri volani funkce knihovny libc. Nevim ale jakeho, chybi mi backtrace.
+<code>
+sfcapd[1407] general protection ip:7f25fab7e119 sp:de0a6b281b401a28 error:0 in libc-2.13.so[7f25faa7d000+18d000]
+</code>
+  * zapnuti coredump
+<code>
+ulimit -c unlimited
+</code>
+  * vytvoril se mi soubor core
+<code>
+Neoprávněný přístup do paměti (SIGSEGV) (core dumped [obraz paměti uložen])
+</code>
+<code>
+gdb /home/bari/Plocha/flowmon-vyvoj/nfdump-1.6.9-nbar-lic3.0-geo-http/bin/sfcapd core
+</code>
+  * ale moc moudra z toho nevypadlo
+<code>
+[195964.091582] sfcapd[1438] general protection ip:7fbe6b62b119 sp:44ca3412556af324 error:0 in libc-2.13.so[7fbe6b52a000+18d000]
+</code>
+<code>
+(gdb) bt
+#0  ____longjmp_chk () at ../sysdeps/unix/sysv/linux/x86_64/____longjmp_chk.S:112
+#1  0x44ca3412556af324 in ?? ()
+Cannot access memory at address 0x44ca3412556af324
+</code>
+===== Systemd coredump =====
+  * systemd se stará i o core dumpy
+  cat /proc/sys/kernel/core_pattern
+  |/usr/lib/systemd/systemd-coredump %p %u %g %s %t %e
+  * podle [[https://www.freedesktop.org/software/systemd/man/systemd-coredump.html|dokumentace]] se coredump vytváří ve složce ''/var/lib/systemd/coredump/*''
+  * je uložen komprimovaně v xz archívu
+  * lze taky použít
+  systemd-coredumpctl list
+  systemd-coredumpctl dump --output /tmp/aaa
+===== Odkazy =====
+  * [[http://lcamtuf.coredump.cx/signals.txt|Moc pekne exploitace pres signal handler]]