When disassembling (32 bit i386 / x86) code on Linux, we sometimes come across instructions like
... call *%gs:0x10 ... movl %gs:0x14, %eax ...
Here, gs refers to the Thread Control Block (TCB) header which stores per-CPU and thread local data (Thread Local Storage, TLS). The Thread Control Block header is a structure which is defined in the C library, for example in eglibc-2.19/nptl/sysdeps/i386/tls.h (slightly simplified and added the gs segment offsets):
typedef struct {
void *tcb; /* gs:0x00 Pointer to the TCB. */
dtv_t *dtv; /* gs:0x04 */
void *self; /* gs:0x08 Pointer to the thread descriptor. */
int multiple_threads; /* gs:0x0c */
uintptr_t sysinfo; /* gs:0x10 Syscall interface */
uintptr_t stack_guard; /* gs:0x14 Random value used for stack protection */
uintptr_t pointer_guard;/* gs:0x18 Random value used for pointer protection */
int gscope_flag; /* gs:0x1c */
int private_futex; /* gs:0x20 */
void *__private_tm[4]; /* gs:0x24 Reservation of some values for the TM ABI. */
void *__private_ss; /* gs:0x34 GCC split stack support. */
} tcbhead_t;
Lets take a closer look at gs:0x10 which I mentioned above: The stack_guard member contains a random value which is used to protect against stack smashing – consider the following sample which contains an obvious buffer overflow:
#include <string.h>
int main() {
char buffer[4];
strcpy(buffer, "Hello World");
return 0;
}
When we compile and run this application, we will get a runtime error:
$ gcc -m32 -o smash smash.c $ ./smash *** stack smashing detected ***: ./smash terminated Aborted (core dumped)
Lets look at the code which is generated by the compiler:
$ gcc -m32 -S -o smash.S smash.c
The following is the (simplified and commented) smash.S file:
main:
; Set up the stack
pushl %ebp
movl %esp, %ebp
andl $-16, %esp
subl $16, %esp
; Set up stack guard
movl %gs:20, %eax ; load random value
movl %eax, 12(%esp) ; store value as a guard variable
xorl %eax, %eax ; make sure that noone can read the random value afterwards
;...
; strcpy ommitted (this overwrites 12(%esp) since the string is too large for the buffer)
;...
; Check stack guard against value from TCB
movl 12(%esp), %edx ; load previously stored value from stack
xorl %gs:20, %edx ; check if still the same
je .L3 ; yes, then fine
call __stack_chk_fail ; print error message and abort()
.L3:
leave
ret
As we see, the compiler inserts instructions at the beginning of the function to set up the stack guard variable, and it inserts instructions at the end of the function to check if the value has changed meanwhile (means, if any code within the function has written beyond the area allocated for local variables and hence has potentially overwritten the return address for the current function). The generation of the stack protection code can be disabled by passing the -fno-stack-protector option to gcc – this is something which should, of course, normally not be done but it can sometimes be useful in order to analyze certain security issues.