Lecture 1. x86

Prof. Taeweon SuhComputer Science &

EngineeringKorea University

COM850 Computer Hacking and Security

Korea Univ

x86?

• What is x86? Generic term referring to processors from Intel, AMD and VIA Derived from the model numbers of the first few generations of processors:

• 8086, 80286, 80386, 80486 x86

Now it generally refers to processors from Intel, AMD, and VIA• x86-16: 16-bit processor• x86-32 (aka IA32): 32-bit processor * IA: Intel Architecture• x86-64: 64-bit processor

• Intel takes about 80% of the PC market and AMD takes about 20% Apple also have been introducing Intel-based Mac from Nov. 2006

2* aka: also known as

Korea Univ

x86 History (as of 2008)

3

Korea Univ

x86 History (Cont.)

4

32-bit (i386)

32-bit (i586) 64-bit (x86_64)32-bit (i686)

8-bit 16-bit 4-bit

2009 20111st Gen. Core i7

(Nehalem)2nd Gen. Core i7(Sandy Bridge)

20123rd Gen. Core i7

(Ivy Bridge)

20134th Gen. Core i7

(Haswell)

8086 in 1978

Korea Univ5

Moore’s Law

• Transistor count will be doubled every 18 months

Exponential growth

2,250

42millions

1.7 billions

Montecito

Korea Univ

Feature Size (Technology) Trend

6

Korea Univ

Power Dissipation

7

• By early 2000, Intel and AMD made every effort to increase clock frequency to enhance the performance of their CPUs

• But, the power consumption is the problem

P ≈ CVDD2f

C: CapacitanceVDD: Voltagef: Frequency

Korea Univ

Power Density Trend

8Source: Intel Corp.

Korea Univ

Watch this!

9

Click the chip

Slide from Prof H.H. Lee in Georgia Tech

Korea Univ

How to Reduce Power Consumption?

• Reduce supply voltage with new technologies i.e., reducing transistor size

• Keep the clock frequency in modest range No longer increase the clock frequency

• Then… what would be the problem?

• So, the strategy is to integrate simple many CPUs in a chip

10

Performance

Dual Core, Quad Core….

Korea Univ11

Multi-core Processor Gala

Prof. Sean Lee’s Slide in Georgia Tech

Korea Univ

Intel’s Core 2 Duo

12

• 2 cores on one chip• Two levels of caches

(L1, L2) on chip• 291 million

transistors in 143 mm2 with 65nm technology

L2 Cache

Core0 Core1

Source: http://www.sandpile.org

DL1 DL1

IL1 IL1

Korea Univ

Intel’s Core i7

13

• 4 cores on one chip• Three levels of

caches (L1, L2, L3) on chip

• 731 million transistors in 263 mm2 with 45nm technology

Korea Univ

Intel’s Core i7 (2nd Gen.)

14

2nd Generation Core i7

995 million transistors in 216 mm2 with 32nm

technology

L1 32 KB

L2 256 KB

L3 8MB

Sandy Bridge

Korea Univ

Intel’s Core i7 (3rd Gen.)

15

3rd Generation Core i7

L1 64 KB

L2 256 KB

L3 8MB

1.4 billion transistors in 160 mm2 with 22nm

technology

http://blog.mytechhelp.com/laptop-repair/the-ivy-bridge/

Korea Univ

AMD’s Opteron – Barcelona (2007)

16

• 4 cores on one chip• 1.9GHz clock• 65nm technology• Three levels of caches (L1, L2, L3) on chip• Integrated North Bridge

Korea Univ

Intel Teraflops Research Chip

• 80 CPU cores• Deliver more than 1 trillion

floating-point operations per second (1 Teraflops) of performance

17

Introduced in September 2006

Korea Univ

Intel’s 48 Core Processor

• 48 x86 cores manufactured with 45nm technology• Nicknamed “single-chip cloud computer”

18

Debuted in December 2009

Korea Univ

Reg File

L1Data cache

L1Inst cache

L2 Cache

MainMemory

DISKSRAM DRAM

Model of Memory Hierarchy

19Slide from Prof Sean Lee in Georgia Tech

Korea Univ20

x86 Operation Modes

• Real Mode (= real address mode) Programming environment of the 8086 processor 8086 is a 16-bit processor from Intel

• Protected Mode Native state of the 32-bit Intel processor 32-bit mode

• IA-32e mode (Intel) or Long mode (AMD) 2 sub modes: Compatibility mode and 64-bit mode

• Compatibility mode is enabled by the operating system on a code segment basis. It means that a single 64-bit OS can support both 64-bit applications running in 64-bit mode and legacy 32-bit applications running in compatibility mode.

Korea Univ

Registers in x86

• Registers in 8086 4 segment registers (16-bit)

• CS, DS, SS, ES

8 general-purpose registers (16-bit) • AX, BX, CX, DX, SP, BP, SI, DI

• Registers in x86-32 (Protected Mode) 6 segment registers (16-bit)

• CS, DS, SS, ES, FS, GS

8 general-purpose registers (32-bit)• EAX, EBX, ECX, EDX, ESP, EBP, ESI, EDI

21

Korea Univ

Registers in x86

• Registers in IA-32e (Long mode) 6 segment registers (16-bit)

• CS, DS, SS, ES, FS, GS

16 general-purpose registers (64-bit)• RAX, RBX, RCX, RDX, RSP, RBP, RSI, RDI, R8 ~ R15

22

Korea Univ

EFLGAS in x86

23

Korea Univ

EFLGAS in x86

24

Korea Univ

Software Compatibility

25AMD64 Architecture Programmer’s Manual. Vol 2 System Programming

Korea Univ26

Segmentation and Paging in Protected Mode

Segmentation

Paging

Korea Univ

TLB in Processor

• Translation Lookaside Buffer (TLB) TLB is there for Virtual Memory

27

Intel Pentium Processor (1993)

virtual address

physical address

data

TLB

Processor

CPU core

Main Memory

Korea Univ28

Real Mode Addressing

• In real mode (8086), general purpose registers are all 16-bit wide Segment registers specify the

base address of each segment Segment registers

• CS: Code Segment for instructions• DS: Data Segment for data• SS: Stack Segment for stack• ES: Extra Segment could be used

to store more data Addressing method

• Segment << 4 + offset = physical address

Main Memory(1MB)

2000hDS

mov ax, 2000h

mov ds, axmov al,

[100h]100hoffset

0x0

0xFFFFF

20000h = 2000h << 4

20100h

Korea Univ29

Protected Mode Addressing

IndexSegment Selector TI

RPL

15 3 2 1 0

GDT LDT

TI = 0 TI = 1

Segment Descriptor

Segment Descriptor

Segment Descriptor

Segment Descriptor

Segment Descriptor

Segment Descriptor

Segment Descriptor

Segment Descriptor

Segment Descriptor

Segment Descriptor

BaseAccess info

31 0 19 0

Limit

CPU Mainmemory

Visible to software

Invisible to software

• TI: Table Indicator• RPL: Requested Privilege Level

Korea Univ30

Segment Descriptor Format

• Software (OS) creates descriptor tables (GDT, LDT)

When S == 1

Korea Univ31

Address Translation in Protected Mode

Korea Univ

Segmentation in Linux (Protected Mode)

• All Linux processes running in User mode or Kernel mode use the same pair of segments to address instruction and data CS, DS bases: 0x0

Limit: 0xfffff (4GB)

• Thus, logical address is the same as linear address

32http://www.c-jump.com/CIS77/ASM/Memory/M77_0240_protected_diagram.htm

Korea Univ

Paging

33

Korea Univ34

Page Translation in Protected Mode(4K Page, Non-PAE)

Korea Univ35

Page Translation in Protected Mode(4KB, PAE)

32-bit linear address

PAE: Physical Address Extension

52-bit physical address

Korea Univ36

Address Translation in 64-bit Mode

• Descriptor (each entry) in GDT and LDT is 16B-wide

• Segmentation is disabled in 64-bit mode Thus, switching a logical processor into

64-bit mode causes it to enforce the Flat Memory Model by largely disabling the segmented memory logic

However, anytime the 64-bit OS kernel causes the logical processor to jump to a 16- or 32-bit legacy code segment, the segmentation logic is immediately re-enabled in order to maintain backward-compatibility

Reference: x86 Instruction Set Architecture, Tom Shanley, MindShare, 2009

Korea Univ

Code Segment Descriptor• Segmentation is disabled in 64-bit mode• Compatibility mode is enabled by the operating system on a code segment basis

37

L (Long) bit 1: 64-bit mode 0: Compatibility mode

AMD64 Architecture Programmer’s Manual. Vol 2 System Programming

Korea Univ38

Page Translation in 64-bit Mode

48-bit linear address

52-bit physical address

Korea Univ

Linear Space Segmentation

• A compiled program’s memory is divided into 5 segments: Text segment (code segment) where

program (assembled machine instructions) is located

Data and bss segments• Data segment is filled with the initialized data

and static variables• bss (Block Started by Symbol) is filled with the

uninitialized data and static variables

Heap segment for dynamic allocation and deallocation of memory using malloc() and free()

Stack segment for scratchpad to store local variables and context during context switch

39

Korea Univ

Stack Frame

• EBP (aka, Frame Pointer (FP) or Local Base (LB) Pointer) for referencing function parameters and local variables in the current stack frame

• Each stack frame contains Parameters to the function Local variables 2 pointers: Saved Frame Pointer (SFP) and

return address• SFP for restoring EBP to its previous value• Return address for restoring EIP to its previous value

40

Korea Univ

Stack Layout with x86

41Source: Reversing, Secrets of Reverse Engineering, Eldad Eilam, 2005

Korea Univ

Stack Frame Example

42

Korea Univ

Stack Frame Example

43

stack

ESP

5

memory

ebp

6

4321

eip (0x8048410)

High address

Low address

( push ebp) ESP EBP (mov ebp, esp)

( sub esp, 0x20) ESP( call 0x8048394) ESP

• Compilation outcome could be different depending on compiler version and optimization flags

Korea Univ

Stack Frame Example

44

stack

ESP

5

memory

ebp

6

4321

eip

High address

Low address

( push ebp) ESP EBP (mov ebp, esp)

( sub esp, 0x20) ESP( call 0x8048394) ESP

ebpResult

(a+b+c+d)J, I, H, GF, E, D, C

B, A

( push ebp) ESP EBP (mov ebp, esp)

( sub esp, 0x10) ESP

0x140x100xC0x080x04

- 0x04

- 0x08

- 0x0C

- 0x10

LEAVE instruction

• Compilation outcome could be different depending on compiler version and optimization flags

Korea Univ

Stack Frame Example

45

stack

ESP

5

memory

ebp

6Result

(a+b+c+d)4321

eip

High address

Low address

( push ebp) ESP EBP (mov ebp, esp)

( sub esp, 0x20) ESP

ebpResult

(a+b+c+d)J, I, H, GF, E, D, C

B, A

after RET instruction

- 0x04

- 0x08

- 0x0C

- 0x10

• Compilation outcome could be different depending on compiler version and optimization flags

Korea Univ46

Backup Slides

Korea Univ

Segment Selector

47

Korea Univ

Floating Point Formats

48

Korea Univ

Debugging Tools

• GDB, the GNU Project Debugger

• DDD, the Data Display Debugger GUI front ends to GDB

• Eclipse Integrated Development Environment (IDE)

Eclipse CDT (C/C++ Development Toolkit)• “Install New Software”

• Name: Galileo

• URL: http://download.eclipse.org/tools/cdt/releases/galileo

• IDA Pro, the Interactive Disassembler Professional Audit binary with no source code

Support more than 50 families of processors

IDA 5.0 is free for non-commercial use

49

Korea Univ

Just in case…

• Compile your code with gcc gcc –g float-d.c -o float-d //

compiled with debugging info• Disassemble the binary with objdump

objdump –M intel –Stx float-d > float-d.dump

50

Korea Univ

GDB

• $ echo “set disassembly-flavor intel” > ~/.gdbinit• Shows disassembly in Intel format (rather than AT&T format)

Operation <destination>, <source> mov ebp, esp ; ebp <- esp

• GDB command summary (gdb) help (gdb) help disass (gdb) list (gdb) list 1,20 (gdb) disass main (gdb) disass /mr main (gdb) info registers (or i r) ; display x86 registers

• Examples: (gdb) i r (gdb) i r $eip (gdb) x ; examine

• (gdb) x/10i $eip ; display 10 instructions from eip• (gdb) x/2x $eip ; display 2 words (4 bytes) in hex. B (byte), h (halfword), w

(word, 4B), g (8B) (gdb) nexti ; execute 1 machine instruction. Will step into subfunctions (gdb) stepi ; execute 1 machine instruction. Will not enter subfunctions (gdb) next ; step program (gdb) step ; step program until it reaches a different source line

51

Korea Univ

x86 Instructions

• CALL – call procedure In 32-bit near call,

• Push EIP of the instruction following the CALL instruction

• Then, branch to the target specified in the operand

• LEAVE – high level procedure exit Release the stack frame set up by an earlier ENTER instruction

In 32-bit,• ESP ← EBP;

• EBP ← pop();

• RET – return from procedure In 32-bit near return,

• EIP ← pop();

52

Korea Univ

x86 Instructions

• PUSH – push word, double-word or quadword onto the stack Decrement the stack pointer and then store the source operand

on the top of the stack

• POP – pop a value from the stack Load the value from the top of the stack and increment the stack

pointer

• LEA – load effective address For instance, LEA ecx, dword ptr [edx+edx]

• ECX ← EDX + EDX;

• Note that even though most disassemblers add the words DWORD PTR before the operands, LEA really can’t distinguish between a pointer and an integer. LEA never performs any actual memory accesses.

53

Korea Univ

x86 Instructions

• TEST Compute the bit-wise logical AND of the first

operand and second operands

Set flags (SF, ZF, and PF) according to the result

Then, discard the result

Example: test eax eax

54

Korea Univ

Buffer Overflow Protection

• gcc –fstack-protector-all• gcc –fno-stack-protector• objdump -SD –disassembler-options=intel stack_example

55http://en.wikipedia.org/wiki/Buffer_overflow_protection