请教一个“段错误”问题

ShareThought

各位大侠,有个shellcode的问题,请大家指点,谢谢!

我的平台是虚拟机上的 redhat 9.0.,kernel为2.4.20-8,gcc为 3.2.2.
编译下面这个样本程序:

char sc[] =     "\x31\xc0"     "\x50"     "\x68\x6e\x2f\x73\x68"     "\x68\x2f\x2f\x62\x69"     "\x89\xe3"     "\x50"     "\x53"     "\x89\xe1"     "\xb0\x0b"     "\xcd\x80" ; int main() {        void    (*fp)(void) = (void (*)(void))sc;        printf("Length: %d\n",strlen(sc));        fp(); }

运行结果：

Length：23
段错误

如果我去掉 程序中： printf("Length: %d\n",strlen(sc));

运行结果是正确的，派生出一个SHELL。

搞不明白怎么回事，请各位大侠指点，再次感谢！

[ 本帖最后由 ShareThought 于 2008-6-17 14:42 编辑 ]

ShareThought

顶上来

让大家看到

xi2008wang

>>fp();

fp是函数指针,不是函数

xi2008wang

来看看gdb调试的过程

1. 
   
2. [xiaodao@dev t]$ gcc -g foo.c
   
3. [xiaodao@dev t]$ gdb ./a.out
   
4. GNU gdb Red Hat Linux (6.6-35.fc8rh)
   
5. Copyright (C) 2006 Free Software Foundation, Inc.
   
6. GDB is free software, covered by the GNU General Public License, and you are
   
7. welcome to change it and/or distribute copies of it under certain conditions.
   
8. Type "show copying" to see the conditions.
   
9. There is absolutely no warranty for GDB.  Type "show warranty" for details.
   
10. This GDB was configured as "i386-redhat-linux-gnu"...
    
11. Using host libthread_db library "/lib/libthread_db.so.1".
    
12. (gdb) list
    
13. 10          "\x50"
    
14. 11          "\x53"
    
15. 12          "\x89\xe1"
    
16. 13          "\xb0\x0b"
    
17. 14          "\xcd\x80"
    
18. 15      ;
    
19. 16
    
20. 17      int main()
    
21. 18      {
    
22. 19             void    (*fp)(void) = (void (*)(void))sc;
    
23. (gdb)
    
24. 20
    
25. 21             printf("Length: %d\n",strlen(sc));
    
26. 22             fp();
    
27. 23      }
    
28. (gdb) b 22
    
29. Breakpoint 1 at 0x804840c: file foo.c, line 22.
    
30. (gdb) r
    
31. Starting program: /home/xiaodao/t/a.out
    
32. 
    
33. warning: Missing the separate debug info file: /usr/lib/debug/.build-id/ac/2eeb206486bb7315d6ac4cd64de0cb50838ff6.debug
    
34. 
    
35. warning: Missing the separate debug info file: /usr/lib/debug/.build-id/ba/4ea1118691c826426e9410cafb798f25cefad5.debug
    
36. Length: 23
    
37. 
    
38. Breakpoint 1, main () at foo.c:22
    
39. 22             fp();
    
40. (gdb) p sc
    
41. $1 = "1hn/shh//bi\211?\211?v?200"
    
42. (gdb) p &sc
    
43. $2 = (char (*)[24]) 0x804966c
    
44. (gdb) p fp
    
45. $3 = (void (*)(void)) 0x804966c <sc>
    
46. (gdb) p &fp
    
47. $4 = (void (**)(void)) 0xbf8ed28c
    
48. (gdb) n
    
49. 
    
50. Program received signal SIGSEGV, Segmentation fault.             //这里收到了SIGSEGV信号
    
51. 0x0804840f in main () at foo.c:22
    
52. 22             fp();
    
53. (gdb)
    

复制代码

ShareThought

谢谢 xi2008wang :wink:

scutan

我在Fc 6中运行没有出现段错误的情况.

ShareThought

不明白 为什么？