Linux 程序保護機制

RELRO (RELocation Read Only)

RELRO	說明	gcc 編譯參數
No	GOT writable, `link_map` writable	`gcc -Wl,-z,norelro code.c`
Partial	GOT writable, `link_map` readonly	DEFAULT
Full	GOT read only, no `link_map` and `dl_resolver` pointer	`gcc -Wl,-z,relro,-z,now code.c`

CANARY

stack overflow - gcc generate canary or not

Canary	gcc 編譯參數
Enable	DEFAULT (when buffer large enough)
Disable	`gcc -fno-stack-protector code.c`

NX (No-Execute) / DEP (Data Execution Prevention)

可以寫的地方不能執行

NX / DEP	gcc 編譯參數	execstack
Enable	DEFAULT	`execstack -s code`
Disable	`gcc -z execstack code.c`	`execstack -c code`

ASLR (Address Space Layout Randomization)

Configuring ASLR with randomize_va_space

0 - 表示關閉進程地址空間隨機化。
1 - 表示 mmap, stack, vdso 隨機化。
2 - 表示比 1 多了 heap 隨機化。

sudo -s echo 0 > /proc/sys/kernel/randomize_va_space
sudo sysctl -w kernel.randomize_va_space=0

PIE (Position Independent Executables)

PIE	gcc 編譯參數
Enable	`gcc -fpie -pie code.c`
Disable	DEFAULT

FRAME POINTER

有開的話是

leave
ret

沒開的話是

add rsp, 0x18
ret

Canary	gcc 編譯參數
Enable	DEFAULT
Disable	`gcc -fomit-frame-pointer code.c`

checksec

checksec 是一個用來查看上述所說的保護機制的 bash script

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      Symbols         FORTIFY Fortified       Fortifiable  FILE
Full RELRO      No canary found   NX enabled    PIE enabled     No RPATH   No RUNPATH   65 Symbols     No       0               1       ./hello

pwntools 也有內建一個名字和功能都一樣的指令

    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      PIE enabled