Basic knowledge-Stack

The operating system is a computer program that manages computer hardware and software resources and is also the core and cornerstone of a computer system. The operating system needs to handle basic transactions such as managing and configuring memory, prioritizing system resource supply and demand, controlling input and output devices, operating networks, and managing file systems. The operating system also provides an operating interface that allows users to interact with the system.

The following points need to be mastered about stacks:

1. The entire memory is managed by the operating system (OS).
2. Each process has its own stack, and the operating system determines the size of the stack allocation,
3. 32-bit systems each process has its own 4G space, 4G is a logical space, and the stack is in 4G logical space.
4. For processes, the process is not managed by the process
5. activity log Block ! A function calls many functions in the run, and each call to a function is handled by the system.
6. Some of the data used, for static data, is placed in the static storage area, and the zone is retracted at the end of the process.
7. The process has control over the heap
8. Attacks against stack heaps are difficult.
9. UAF (use after free), occurs in the heap, others are managed by the system.
10. The system management stack uses a large number of registers
11. Ax a represents an accumulator
12. A pointer to a dynamically allocated memory stored in the stack
13. Within the operating system, the stack is a high-to-low address extension of the data structure, is a contiguous area of memory, the top of the stack address and the maximum capacity of the stack is the system pre-defined , can be obtained from the stack less space.
14. A heap is a data structure that is extended by a low-to-high address, which is a discontinuous area of memory, because the system is stored/organized by a list of free memory addresses, the natural heap is a discontinuous memory area, and the traversal of the list is from the low address to the high address, the heap size is limited by the effective virtual memory space of computer The space for the heap is more flexible and larger.

Stack VS Heap

The efficiency of the application is different:

1. The stack is automatically assigned by the system and is fast, but the programmer cannot control it.
2. The heap is allocated by programmers themselves, slow and prone to fragmentation, but easy to use.
3. The stack is faster because all the free memory is contiguous, so there is no need to maintain a list of free memory blocks. Just a simple pointer to the top of the current stack. Compilers are typically implemented with a dedicated, fast register. More importantly, the subsequent operations on the stack are usually centered around a block of memory, which facilitates high-speed processor access. (Principle of locality)

Dynamic memory allocation

The parameters of malloc are the number of bytes of memory that need to be allocated. If available memory in the memory pool satisfies this requirement, malloc returns a pointer to the starting position of the allocated memory block.

The 1>malloc allocates a contiguous amount of memory. For example, if a request allocates 100 bytes of memory, then it actually allocates 100 contiguous bytes of memory, and does not separate in two or more different memory. At the same time, malloc actually allocates a bit more memory than you might have requested. However, this is defined by the compiler.

2> If the memory pool is empty, or if its available memory does not meet the requirements. in this case, the malloc () function requests to the operating system to obtain more memory and to perform allocation tasks on this block of memory. if the operating system cannot provide more memory to malloc, malloc returns a null pointer. Therefore, it is important to check each pointer returned from malloc to make sure it is not null.

Question: Can the memory pool size change?

Common Dynamic Memory errors

1. Many errors often occur in programs that use dynamic memory allocation.

   1> a null pointer to a dereference operation
   2> crossing a boundary when operating on allocated memory
   3> releasing memory that is not dynamically allocated
   4> attempts to release a portion of a dynamically allocated memory and a chunk of memory is freed after it is resumed.
   Description:
   * * The most common error in dynamic allocation is forgetting to check that the requested memory is successfully allocated.
   The second major source of error for dynamic memory allocation is that the memory is being manipulated beyond the bounds of allocated memory. **

2. When you use free, you may have different kinds of errors

   1> the pointer passed to free must be a pointer returned from the malloc, calloc, or realloc functions.
   2> passes a pointer to the free function, letting it release a piece of memory that is not dynamically allocated may cause the program to terminate immediately or terminate at a later time.
   3> attempts to release part of a dynamically allocated memory can also cause similar problems, such as free (pi + 5);

   Releasing part of a piece of memory is not allowed. Dynamically allocated memory must be released together with the whole block. However, the REALLOC function reduces the amount of dynamically allocated memory, effectively releasing part of its tail memory.

   4> do not access memory that has been freed by the free function.

How the system stack works different uses of memory

Regardless of the operating system or computer structure, the memory used by a process is roughly divided into the following 4 sections according to function

• Code area (. Text): The binary code that is transferred to execution is stored and the processor is referred to and executed in the region. The text segment disables write permissions because the segment is not used to store variables, but only to store code. Can prevent people from modifying program code. (One advantage of this paragraph read-only is that it can be shared by different copies of the program, making it possible to execute the program multiple times without any problems.) Note: This section is fixed because there is nothing to change. ）
• Data area (. Data &&. BSS): Stores Global and static program variables. The data section is filled with the initialized global variables, strings, and other constants that are used by the entire program to run the process. The BSS segment is filled with the corresponding uninitialized content. Although these segments can be rewritten, they also have a fixed size
• Heap: The process can then dynamically request a certain amount of memory in the heap and return it to the stack when it is exhausted. Dynamic allocation and recycling is a feature of the heap area. variable size, low address want high address increase
• Stack: The call relationship between dynamic storage functions to ensure that the called function resumes in the parent function when it returns. Variable Size

The difference between the user stack and the kernel stack

Operating system, each process will have two stacks, a user stack, exists in the user space, a kernel stack, exists in the kernel space. When the process runs in user space, the contents of the CPU stack pointer register are the user stack address, the user stack is used, and when the process is in kernel space, the contents of the CPU stack pointer register are the kernel stack space address, using the kernel stack.

The kernel stack is an area of memory that is part of the operating system space, and its main uses are:

1) Save interrupt site, for nested interrupts, the field information of the interrupted program is pressed into the system stack, and the reverse is ejected when the interrupt returns;

2) Save local variables of the parameters, return values, return points, and subroutines (functions) that are called between the operating system sub-programs.

The user stack is an area in the user process space that holds the parameters, return values, return points, and local variables of subroutines (functions) that are called among the subroutines of the user process.

PS: So why not use a stack directly, why waste so much space?
1) If only the system stack is used. System stack general size is limited, if the interrupt has 16 priority, then the system stack general size is 15 (just save 15 low-priority interrupts, another high-priority interrupt handler is running), but the number of user program subroutine calls may be many, so 15 subroutine calls after the subroutine call parameters, The local variables of the return value, the return point, and the subroutine (function) cannot be saved and the user program will not function properly.

2) If only the user stack is used. We know that the system program needs to run under some kind of protection, and the user stack is protected when the user space (i.e. the CPU is in the user state while the CPU is in the kernel mentality) and cannot provide the appropriate protection (or quite difficult).

Stack Overflow

A stack overflow is a buffer overflow. In the process of running the program, in order to temporarily access the data needs, it is generally necessary to allocate some memory space, usually called the buffer space. If you write data to a buffer that exceeds its own length, so that the buffer does not fit, it causes the storage unit outside the buffer to be overwritten, a phenomenon called a buffer overflow. The buffer length is generally related to the type of buffer variable that is defined by the user.

The use of buffer overflows to make useful storage units rewritten can often lead to unpredictable consequences. Writing arbitrary data to these units usually results in an accident such as a program crash, and we can say at most that this program has bugs. But if you write carefully prepared data to these cells, it can cause the program process to be hijacked, causing unwanted code to be executed and falling into the control of the attacker, not just bugs, but vulnerabilities (exploit).

Note: Buffers are only part of a process stack and cannot be equated with stack space .

Register and function Stack frames

Each function exclusively has its own stack frame space. The stack frame of the currently running function is always at the top of the stack. The WIN32 system provides two special registers to identify the stack frame at the top of the system stack.

(1) ESP: Stack pointer register (extended stack pointer), which holds a pointer that always points to the top of the stack frame at the top of the system stack.

(2) EBP: Base point pointer Register (extended base pointer), which holds a pointer that always points to the bottom of the top stack frame of the system stack.

function stack frame: the memory space between ESP and EBP is the current stack frame, EBP identifies the bottom of the current stack frame, and ESP identifies the top of the current stack frame.

In a function stack frame, the following types of important information are generally included.

(1) Local variables: The memory space opened up for function local variables.

(2) Stack frame status value: Save the top and bottom of the front stack frame (actually save only the bottom of the front stack frame, the top of the front stack frame can be calculated by the stack frame balance), for the stack is ejected after the previous stack frame is restored.

(3) function return address: Saves the "breakpoint" information before the current function call, that is, the position of the instruction before the function call, so that it can resume execution of the instruction in the code area before the function is called when the function returns.

Note: The size of the function stack frame is not fixed, it is generally related to the local variable of its corresponding function. While the function is running, its stack frame size is constantly changing. In addition to the stack-related registers, we also need to remember another vital register.

EIP: Instruction register (extended instruction pointer), which holds a pointer that always points to the next command address to be executed. It can be said that if the content of the EIP register is controlled, the process is controlled-where we let the EIP point, the CPU executes the instructions. Wang Shuang Teacher's assembly inside said the EIP is already very good

Reference Links:

1. How the system stack works
2. How the system stack works--code farming network
3. Heap Space & Stack space && dynamic memory allocation
4. "In-depth understanding of computer systems" notes (a) stack

Problem:
1. Is the stack space allocated by each process determined by the operating system? Does it have to do with the compiler? (see where the compiler is also related)
2. Does the kernel stack and user stack have a 4G stack within each process that is said to be subdivided?

Basic knowledge-stack