欢迎您访问程序员文章站本站旨在为大家提供分享程序员计算机编程知识!
您现在的位置是: 首页  >  网络运营

linux下system函数的简单分析

程序员文章站 2023-11-11 13:21:58
简单分析了linux下system函数的相关内容,具体内容如下 int __libc_system (const char *line) { if (li...

简单分析了linux下system函数的相关内容,具体内容如下

int
__libc_system (const char *line)
{
 if (line == null)
  /* check that we have a command processor available. it might
    not be available after a chroot(), for example. */
  return do_system ("exit 0") == 0;

 return do_system (line);
}
weak_alias (__libc_system, system)

代码位于glibc/sysdeps/posix/system.c,这里system是__libc_system的弱别名,而__libc_system是do_system的前端函数,进行了参数的检查,接下来看do_system函数。

static int
do_system (const char *line)
{
 int status, save;
 pid_t pid;
 struct sigaction sa;
#ifndef _libc_reentrant
 struct sigaction intr, quit;
#endif
 sigset_t omask;

 sa.sa_handler = sig_ign;
 sa.sa_flags = 0;
 __sigemptyset (&sa.sa_mask);

 do_lock ();
 if (add_ref () == 0)
  {
   if (__sigaction (sigint, &sa, &intr) < 0)
  {
   (void) sub_ref ();
   goto out;
  }
   if (__sigaction (sigquit, &sa, &quit) < 0)
  {
   save = errno;
   (void) sub_ref ();
   goto out_restore_sigint;
  }
  }
 do_unlock ();

 /* we reuse the bitmap in the 'sa' structure. */
 __sigaddset (&sa.sa_mask, sigchld);
 save = errno;
 if (__sigprocmask (sig_block, &sa.sa_mask, &omask) < 0)
  {
#ifndef _libc
   if (errno == enosys)
  __set_errno (save);
   else
#endif
  {
   do_lock ();
   if (sub_ref () == 0)
    {
     save = errno;
     (void) __sigaction (sigquit, &quit, (struct sigaction *) null);
    out_restore_sigint:
     (void) __sigaction (sigint, &intr, (struct sigaction *) null);
     __set_errno (save);
    }
  out:
   do_unlock ();
   return -1;
  }
  }

#ifdef cleanup_handler
 cleanup_handler;
#endif

#ifdef fork
 pid = fork ();
#else
 pid = __fork ();
#endif
 if (pid == (pid_t) 0)
  {
   /* child side. */
   const char *new_argv[4];
   new_argv[0] = shell_name;
   new_argv[1] = "-c";
   new_argv[2] = line;
   new_argv[3] = null;

   /* restore the signals. */
   (void) __sigaction (sigint, &intr, (struct sigaction *) null);
   (void) __sigaction (sigquit, &quit, (struct sigaction *) null);
   (void) __sigprocmask (sig_setmask, &omask, (sigset_t *) null);
   init_lock ();

   /* exec the shell. */
   (void) __execve (shell_path, (char *const *) new_argv, __environ);
   _exit (127);
  }
 else if (pid < (pid_t) 0)
  /* the fork failed. */
  status = -1;
 else
  /* parent side. */
  {
   /* note the system() is a cancellation point. but since we call
   waitpid() which itself is a cancellation point we do not
   have to do anything here. */
   if (temp_failure_retry (__waitpid (pid, &status, 0)) != pid)
  status = -1;
  }

#ifdef cleanup_handler
 cleanup_reset;
#endif

 save = errno;
 do_lock ();
 if ((sub_ref () == 0
    && (__sigaction (sigint, &intr, (struct sigaction *) null)
    | __sigaction (sigquit, &quit, (struct sigaction *) null)) != 0)
   || __sigprocmask (sig_setmask, &omask, (sigset_t *) null) != 0)
  {
#ifndef _libc
   /* glibc cannot be used on systems without waitpid. */
   if (errno == enosys)
  __set_errno (save);
   else
#endif
  status = -1;
  }
 do_unlock ();

 return status;
}

do_system

首先函数设置了一些信号处理程序,来处理sigint和sigquit信号,此处我们不过多关心,关键代码段在这里

#ifdef fork
 pid = fork ();
#else
 pid = __fork ();
#endif
 if (pid == (pid_t) 0)
  {
   /* child side. */
   const char *new_argv[4];
   new_argv[0] = shell_name;
   new_argv[1] = "-c";
   new_argv[2] = line;
   new_argv[3] = null;

   /* restore the signals. */
   (void) __sigaction (sigint, &intr, (struct sigaction *) null);
   (void) __sigaction (sigquit, &quit, (struct sigaction *) null);
   (void) __sigprocmask (sig_setmask, &omask, (sigset_t *) null);
   init_lock ();

   /* exec the shell. */
   (void) __execve (shell_path, (char *const *) new_argv, __environ);
   _exit (127);
  }
 else if (pid < (pid_t) 0)
  /* the fork failed. */
  status = -1;
 else
  /* parent side. */
  {
   /* note the system() is a cancellation point. but since we call
   waitpid() which itself is a cancellation point we do not
   have to do anything here. */
   if (temp_failure_retry (__waitpid (pid, &status, 0)) != pid)
  status = -1;
  }

首先通过前端函数调用系统调用fork产生一个子进程,其中fork有两个返回值,对父进程返回子进程的pid,对子进程返回0。所以子进程执行6-24行代码,父进程执行30-35行代码。

子进程的逻辑非常清晰,调用execve执行shell_path指定的程序,参数通过new_argv传递,环境变量为全局变量__environ。

其中shell_path和shell_name定义如下

#define  shell_path  "/bin/sh"  /* path of the shell. */
#define  shell_name  "sh"    /* name to give it. */ 

其实就是生成一个子进程调用/bin/sh -c "命令"来执行向system传入的命令。 

下面其实是我研究system函数的原因与重点:

在ctf的pwn题中,通过栈溢出调用system函数有时会失败,听师傅们说是环境变量被覆盖,但是一直都是懵懂,今天深入学习了一下,总算搞明白了。

在这里system函数需要的环境变量储存在全局变量__environ中,那么这个变量的内容是什么呢。

__environ是在glibc/csu/libc-start.c中定义的,我们来看几个关键语句。

# define libc_start_main __libc_start_main

__libc_start_main是_start调用的函数,这涉及到程序开始时的一些初始化工作,对这些名词不了解的话可以看一下这篇文章。接下来看libc_start_main函数。

static int
libc_start_main (int (*main) (int, char **, char ** main_auxvec_decl),
     int argc, char **argv,
#ifdef libc_start_main_auxvec_arg
     elfw(auxv_t) *auxvec,
#endif
     __typeof (main) init,
     void (*fini) (void),
     void (*rtld_fini) (void), void *stack_end)
{
 /* result of the 'main' function. */
 int result;

 __libc_multiple_libcs = &_dl_starting_up && !_dl_starting_up;

#ifndef shared
 char **ev = &argv[argc + 1];

 __environ = ev;

 /* store the lowest stack address. this is done in ld.so if this is
   the code for the dso. */
 __libc_stack_end = stack_end;

    ......
 /* nothing fancy, just call the function. */
 result = main (argc, argv, __environ main_auxvec_param);
#endif

 exit (result);
}

我们可以看到,在没有define shared的情况下,在第19行定义了__environ的值。启动程序调用libc_start_main之前,会先将环境变量和argv中的字符串保存起来(其实是保存到栈上),然后依次将环境变量中各项字符串的地址,argv中各项字符串的地址和argc入栈,所以环境变量数组一定位于argv数组的正后方,以一个空地址间隔。所以第17行的&argv[argc + 1]语句就是取环境变量数组在栈上的首地址,保存到ev中,最终保存到__environ中。第203行调用main函数,会将__environ的值入栈,这个被栈溢出覆盖掉没什么问题,只要保证__environ中的地址处不被覆盖即可。

所以,当栈溢出的长度过大,溢出的内容覆盖了__environ中地址中的重要内容时,调用system函数就会失败。具体环境变量距离溢出地址有多远,可以通过在_start中下断查看。

以上就是本文的全部内容,希望对大家的学习有所帮助,也希望大家多多支持。