如何动态生成X86_64以返回相对于RIP / RBP的值

Question

I'm trying to read values in memory relative to the %rip on X86_64. In my first example I just want to read

If I write the following code in C, I can call it and get the correct result ( \\x....C3C9 ):

void * test() {
    __asm("mov 0(%rip), %rax");
}

The generated code looks as follows:

0000000000400624 <test>:
  400624:   55                      push   %rbp
  400625:   48 89 e5                mov    %rsp,%rbp
  400628:   48 8b 05 00 00 00 00    mov    0x0(%rip),%rax        # 40062f <test+0xb>
  40062f:   c9                      leaveq 
  400630:   c3                      retq 

If I now however put this code directly in memory and execute it I get a segfault, while I would expect to read \\x0000C3C9 :

int main()
{
    int codesize = 9;
    unsigned char * code = (unsigned char*)malloc(1024);
    memcpy(code, "\x48\x8B\x5\x0\x0\x0\x0\xC9\xC3\x00\x00", codesize + 2);
    mprotect(code, codesize, PROT_EXEC | PROT_READ);
    goto *code;
}

What am I doing wrong?

edit The answer is that I shouldn't have used malloc but mmap to allocate a page-aligned memory region:

(unsigned char*)mmap(NULL, 1024, PROT_WRITE | PROT_READ, MAP_ANONYMOUS | MAP_SHARED, -1, 0);

And of course I should have checked the return value of the call to mprotect . It returned -1 flagging that it had failed.

Answer 1

You most likely get the SIGSEGV during the mprotect() call. If the code execution of the memory returned by malloc() is disallowed by the OS (it most likely is if you aren't using some ancient kernel), mprotect() just segfaults. That's not a bug, it's a feature.

Answer 2

the ret instruction is basically a pop value from the stack; goto value pop value from the stack; goto value .

When you goto <your_code> , ret eventually gets executed the problem is that you have garbage on the stack (maybe the ret instruction tries to goto 9 because codesize is the variable on the top of the stack, who knows...).

Basically, it doesn't work because you are using your asm snippet incorrectly.

May I ask what you are trying to do ? I could help :)

---

A test program to get your rip:

static inline unsigned long get_rip(void)
{
    unsigned long val;
    asm volatile(
        "call 1f\n"
        "1: popq %0\n"
        : "=r"(val));
    return val;
}

int main()
{
    printf("rip = %p\n", (void *)get_rip());
    return 0;
}