SPARC assembly - a beginner's question...

Hi all,

I've been reading/working through Dave Litchfield's "Buffer Overflows on the
SPARC Architecture" paper (http://www.nextgenss.com/papers/sparc.zip).

I follow everything (I think) - and it all works up until the point where I
write my own version of asmshell.c in an attempt to open a shell in asm. The
C code we are emulating looks like:

int main()
{
  char *buffer[2];
  buffer[0]="/bin/sh";
  buffer[1]=NULL;

  execve(buffer[0],buffer,NULL);
}

My assembly version of the above looks like:

void main()
{
  __asm__("
    set 0x2F62696E, %o0   ! %o0=/bin
    st %o0, [%fp-8]       ! push ^ onto stack
    set 0x2F736800, %o0   ! %o0=/sh\0
    st %o0, [%fp-4]       ! push ^ onto stack
    add %fp, -8, %o0      ! %o0=address of string
    or %g0, %g0, [%fp-12] ! clear %fp-12
    st %o0, [%fp-16]      ! write pointer to string onto stack
    add %fp, -16, %o1     ! %o1=pointer to pointer to string
    or %g0, %g0, %o2      ! %o2=NULL
    mov 0x3b, %g1         ! set value in global register
    ta 8                  ! system trap
  ");
}

NB: I have changed Dave's example slightly - expanding "clr [%fp-12]" to "or
%g0, %g0, [%fp-12]" and swapping "xor %o2, %o2, %o2" for "or %g0, %g0, %o2"
(as I understand it - "clr {address}" is simply a macro for "or %g0, %g0,
{address}" anyway?).

Running the C code results in a new shell running. Running my assembly code
does not.

I my code, I have:

%o0 pointing to the null-terminated "/bin/sh" string;
%o1 pointing to the pointer to our string;
%o2 set to NULL;
%g1 set to 0x3b.

So, shouldn't calling "ta 8" result in a shell being run? What am I missing?

If I load the binary into gdb and take a look, a lot of it seems to be
missing:

(gdb) disas main
Dump of assembler code for function main:
0x109b8 <main>: save  %sp, -112, %sp
0x109bc <main+4>:       sethi  %hi(0x2f626800), %o0
0x109c0 <main+8>:       or  %o0, 0x16e, %o0     ! 0x2f62696e
0x109c4 <main+12>:      st  %o0, [ %fp + -8 ]
0x109c8 <main+16>:      sethi  %hi(0x2f736800), %o0
0x109cc <main+20>:      nop
0x109d0 <main+24>:      ret
0x109d4 <main+28>:      restore
End of assembler dump.

However - I don't know if it's my poor ASM breaking things or something the
compiler/debugger is doing. I've searched high and low on the web for SPARC
assembly references - but aren't finding anything sufficiently idiot-proof.

Any ideas, anyone?

Cheers,

Steve.

--
Stephen Wilson
Senior Security Consultant
Security Health Check

L305/9, QinetiQ, St Andrews Rd, Malvern, Worcs, WR14 3PS
Tel: 01684 894153  Fax: 01684 897417