linux下system函数的简单分析
简单分析了linux下system函数的相关内容,具体内容如下
int __libc_system (const char *line) { if (line == null) /* check that we have a command processor available. it might not be available after a chroot(), for example. */ return do_system ("exit 0") == 0; return do_system (line); } weak_alias (__libc_system, system)
代码位于glibc/sysdeps/posix/system.c,这里system是__libc_system的弱别名,而__libc_system是do_system的前端函数,进行了参数的检查,接下来看do_system函数。
static int do_system (const char *line) { int status, save; pid_t pid; struct sigaction sa; #ifndef _libc_reentrant struct sigaction intr, quit; #endif sigset_t omask; sa.sa_handler = sig_ign; sa.sa_flags = 0; __sigemptyset (&sa.sa_mask); do_lock (); if (add_ref () == 0) { if (__sigaction (sigint, &sa, &intr) < 0) { (void) sub_ref (); goto out; } if (__sigaction (sigquit, &sa, &quit) < 0) { save = errno; (void) sub_ref (); goto out_restore_sigint; } } do_unlock (); /* we reuse the bitmap in the 'sa' structure. */ __sigaddset (&sa.sa_mask, sigchld); save = errno; if (__sigprocmask (sig_block, &sa.sa_mask, &omask) < 0) { #ifndef _libc if (errno == enosys) __set_errno (save); else #endif { do_lock (); if (sub_ref () == 0) { save = errno; (void) __sigaction (sigquit, &quit, (struct sigaction *) null); out_restore_sigint: (void) __sigaction (sigint, &intr, (struct sigaction *) null); __set_errno (save); } out: do_unlock (); return -1; } } #ifdef cleanup_handler cleanup_handler; #endif #ifdef fork pid = fork (); #else pid = __fork (); #endif if (pid == (pid_t) 0) { /* child side. */ const char *new_argv[4]; new_argv[0] = shell_name; new_argv[1] = "-c"; new_argv[2] = line; new_argv[3] = null; /* restore the signals. */ (void) __sigaction (sigint, &intr, (struct sigaction *) null); (void) __sigaction (sigquit, &quit, (struct sigaction *) null); (void) __sigprocmask (sig_setmask, &omask, (sigset_t *) null); init_lock (); /* exec the shell. */ (void) __execve (shell_path, (char *const *) new_argv, __environ); _exit (127); } else if (pid < (pid_t) 0) /* the fork failed. */ status = -1; else /* parent side. */ { /* note the system() is a cancellation point. but since we call waitpid() which itself is a cancellation point we do not have to do anything here. */ if (temp_failure_retry (__waitpid (pid, &status, 0)) != pid) status = -1; } #ifdef cleanup_handler cleanup_reset; #endif save = errno; do_lock (); if ((sub_ref () == 0 && (__sigaction (sigint, &intr, (struct sigaction *) null) | __sigaction (sigquit, &quit, (struct sigaction *) null)) != 0) || __sigprocmask (sig_setmask, &omask, (sigset_t *) null) != 0) { #ifndef _libc /* glibc cannot be used on systems without waitpid. */ if (errno == enosys) __set_errno (save); else #endif status = -1; } do_unlock (); return status; } do_system
首先函数设置了一些信号处理程序,来处理sigint和sigquit信号,此处我们不过多关心,关键代码段在这里
#ifdef fork pid = fork (); #else pid = __fork (); #endif if (pid == (pid_t) 0) { /* child side. */ const char *new_argv[4]; new_argv[0] = shell_name; new_argv[1] = "-c"; new_argv[2] = line; new_argv[3] = null; /* restore the signals. */ (void) __sigaction (sigint, &intr, (struct sigaction *) null); (void) __sigaction (sigquit, &quit, (struct sigaction *) null); (void) __sigprocmask (sig_setmask, &omask, (sigset_t *) null); init_lock (); /* exec the shell. */ (void) __execve (shell_path, (char *const *) new_argv, __environ); _exit (127); } else if (pid < (pid_t) 0) /* the fork failed. */ status = -1; else /* parent side. */ { /* note the system() is a cancellation point. but since we call waitpid() which itself is a cancellation point we do not have to do anything here. */ if (temp_failure_retry (__waitpid (pid, &status, 0)) != pid) status = -1; }
首先通过前端函数调用系统调用fork产生一个子进程,其中fork有两个返回值,对父进程返回子进程的pid,对子进程返回0。所以子进程执行6-24行代码,父进程执行30-35行代码。
子进程的逻辑非常清晰,调用execve执行shell_path指定的程序,参数通过new_argv传递,环境变量为全局变量__environ。
其中shell_path和shell_name定义如下
#define shell_path "/bin/sh" /* path of the shell. */ #define shell_name "sh" /* name to give it. */
其实就是生成一个子进程调用/bin/sh -c "命令"来执行向system传入的命令。
下面其实是我研究system函数的原因与重点:
在ctf的pwn题中,通过栈溢出调用system函数有时会失败,听师傅们说是环境变量被覆盖,但是一直都是懵懂,今天深入学习了一下,总算搞明白了。
在这里system函数需要的环境变量储存在全局变量__environ中,那么这个变量的内容是什么呢。
__environ是在glibc/csu/libc-start.c中定义的,我们来看几个关键语句。
# define libc_start_main __libc_start_main
__libc_start_main是_start调用的函数,这涉及到程序开始时的一些初始化工作,对这些名词不了解的话可以看一下这篇文章。接下来看libc_start_main函数。
static int libc_start_main (int (*main) (int, char **, char ** main_auxvec_decl), int argc, char **argv, #ifdef libc_start_main_auxvec_arg elfw(auxv_t) *auxvec, #endif __typeof (main) init, void (*fini) (void), void (*rtld_fini) (void), void *stack_end) { /* result of the 'main' function. */ int result; __libc_multiple_libcs = &_dl_starting_up && !_dl_starting_up; #ifndef shared char **ev = &argv[argc + 1]; __environ = ev; /* store the lowest stack address. this is done in ld.so if this is the code for the dso. */ __libc_stack_end = stack_end; ...... /* nothing fancy, just call the function. */ result = main (argc, argv, __environ main_auxvec_param); #endif exit (result); }
我们可以看到,在没有define shared的情况下,在第19行定义了__environ的值。启动程序调用libc_start_main之前,会先将环境变量和argv中的字符串保存起来(其实是保存到栈上),然后依次将环境变量中各项字符串的地址,argv中各项字符串的地址和argc入栈,所以环境变量数组一定位于argv数组的正后方,以一个空地址间隔。所以第17行的&argv[argc + 1]语句就是取环境变量数组在栈上的首地址,保存到ev中,最终保存到__environ中。第203行调用main函数,会将__environ的值入栈,这个被栈溢出覆盖掉没什么问题,只要保证__environ中的地址处不被覆盖即可。
所以,当栈溢出的长度过大,溢出的内容覆盖了__environ中地址中的重要内容时,调用system函数就会失败。具体环境变量距离溢出地址有多远,可以通过在_start中下断查看。
以上就是本文的全部内容,希望对大家的学习有所帮助,也希望大家多多支持。
下一篇: SQL2008删除堵塞进程sp_who