为什么数据和堆栈段是可执行的?

问题描述

我刚刚注意到我的简单程序的数据和堆栈段是可执行的.我在/proc/[pid]/maps中看到了，简单的代码就证实了.

I have just noticed that my simple program has its data and stack segments executable.I saw it in /proc/[pid]/maps, and simple code confirmed it.

例如:

; prog.asm
section .data
    code:   db 0xCC    ;int3

section .text
global _start
_start:
    jmp    code

    mov    rax, 60    ; sys_exit
    mov    rdi, 0
    syscall

然后

nasm -f elf64 prog.asm
ld -o prog prog.o
./prog

使 prog 执行 int3 指令.

causes prog to execute int3 instruction.

用 C 编写并用 gcc 构建的程序的数据、堆栈和堆是不可执行的，那么为什么用汇编编写的程序的行为方式不同?

Programs written in C and built with gcc have their data, stack and heap non-executable, so why those written in assembly behave in a different manner?

推荐答案

在现代 Linux 系统上，链接器会将堆栈/数据标记为不可执行 IFF 所有参与链接的对象都有一个特殊的标记".note.GNU-stack 部分.

On modern Linux systems, the linker will mark stack/data non-executable IFF all objects that participate in the link have a special "marker" section .note.GNU-stack.

如果你编译例如int foo() { return 1;} 到汇编中(使用 gcc -S foo.c)，你会看到:

If you compile e.g. int foo() { return 1; } into assembly (with gcc -S foo.c), you'll see this:

    .section    .note.GNU-stack,"",@progbits

对于nasm，语法显示在手册的第 8.9.2 节;你想要这样的东西:

For nasm, the syntax is shown in section 8.9.2 of the manual; you want something like this:

 section .note.GNU-stack noalloc noexec nowrite progbits

---

注意

必须对进入可执行文件的每个 .o 文件执行此操作.如果任何目标文件需要可执行堆栈或数据，则为整个段设置.

---

Note

This has to be done for every .o file that goes into the executable. If any object file needs executable stack or data, then it's set for the entire segment.

这篇关于为什么数据和堆栈段是可执行的?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！