请教一个“段错误”问题

ShareThought

各位大侠,有个shellcode的问题,请大家指点,谢谢!\r\n\r\n我的平台是虚拟机上的 redhat 9.0.,kernel为2.4.20-8,gcc为 3.2.2.\r\n编译下面这个样本程序:\r\n\r\n

char sc[] =\r\n    \"\\x31\\xc0\"\r\n    \"\\x50\"\r\n    \"\\x68\\x6e\\x2f\\x73\\x68\"\r\n    \"\\x68\\x2f\\x2f\\x62\\x69\"\r\n    \"\\x89\\xe3\"\r\n    \"\\x50\"\r\n    \"\\x53\"\r\n    \"\\x89\\xe1\"\r\n    \"\\xb0\\x0b\"\r\n    \"\\xcd\\x80\"\r\n;\r\nint main()\r\n{\r\n       void    (*fp)(void) = (void (*)(void))sc;\r\n\r\n       printf(\"Length: %d\\n\",strlen(sc));\r\n       fp();\r\n}\r\n

\r\n\r\n\r\n运行结果：\r\n\r\nLength：23\r\n段错误\r\n\r\n如果我去掉 程序中： printf(\"Length: %d\\n\",strlen(sc));\r\n\r\n运行结果是正确的，派生出一个SHELL。\r\n\r\n搞不明白怎么回事，请各位大侠指点，再次感谢！\n\n[ 本帖最后由 ShareThought 于 2008-6-17 14:42 编辑 ]

ShareThought

顶上来\r\n\r\n让大家看到

xi2008wang

>>fp();\r\n\r\nfp是函数指针,不是函数

xi2008wang

来看看gdb调试的过程\r\n

1. \r\n[xiaodao@dev t]$ gcc -g foo.c \r\n[xiaodao@dev t]$ gdb ./a.out \r\nGNU gdb Red Hat Linux (6.6-35.fc8rh)\r\nCopyright (C) 2006 Free Software Foundation, Inc.\r\nGDB is free software, covered by the GNU General Public License, and you are\r\nwelcome to change it and/or distribute copies of it under certain conditions.\r\nType \"show copying\" to see the conditions.\r\nThere is absolutely no warranty for GDB.  Type \"show warranty\" for details.\r\nThis GDB was configured as \"i386-redhat-linux-gnu\"...\r\nUsing host libthread_db library \"/lib/libthread_db.so.1\".\r\n(gdb) list\r\n10          \"\\x50\"\r\n11          \"\\x53\"\r\n12          \"\\x89\\xe1\"\r\n13          \"\\xb0\\x0b\"\r\n14          \"\\xcd\\x80\"\r\n15      ;\r\n16\r\n17      int main()\r\n18      {\r\n19             void    (*fp)(void) = (void (*)(void))sc;\r\n(gdb) \r\n20\r\n21             printf(\"Length: %d\\n\",strlen(sc));\r\n22             fp();\r\n23      }\r\n(gdb) b 22\r\nBreakpoint 1 at 0x804840c: file foo.c, line 22.\r\n(gdb) r\r\nStarting program: /home/xiaodao/t/a.out \r\n\r\nwarning: Missing the separate debug info file: /usr/lib/debug/.build-id/ac/2eeb206486bb7315d6ac4cd64de0cb50838ff6.debug\r\n\r\nwarning: Missing the separate debug info file: /usr/lib/debug/.build-id/ba/4ea1118691c826426e9410cafb798f25cefad5.debug\r\nLength: 23\r\n\r\nBreakpoint 1, main () at foo.c:22\r\n22             fp();\r\n(gdb) p sc\r\n$1 = \"1hn/shh//bi\\211?\\211?v?200\"\r\n(gdb) p &sc\r\n$2 = (char (*)[24]) 0x804966c\r\n(gdb) p fp\r\n$3 = (void (*)(void)) 0x804966c <sc>\r\n(gdb) p &fp\r\n$4 = (void (**)(void)) 0xbf8ed28c\r\n(gdb) n\r\n\r\nProgram received signal SIGSEGV, Segmentation fault.             //这里收到了SIGSEGV信号\r\n0x0804840f in main () at foo.c:22\r\n22             fp();\r\n(gdb) \r\n

复制代码

ShareThought

谢谢 xi2008wang :wink:

scutan

我在Fc 6中运行没有出现段错误的情况.

ShareThought

不明白 为什么？