Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

libc: Add support for stack smash canaries in debug variants. #98

Merged
merged 1 commit into from
Jun 4, 2024

Conversation

asiekierka
Copy link
Contributor

@asiekierka asiekierka commented May 31, 2024

I have checked the resulting ELFs, but haven't actually tried to smash the stack - however, I followed the ideas of retarget_lock_crash.

(Stack smash protection will work in non-debug variants, too, albeit without libnds functions themselves being protected.)

@asiekierka
Copy link
Contributor Author

Solves half of blocksds/sdk#150 .

@AntonioND
Copy link
Member

I can't test this, I've tried for about an hour and it just won't work for me. For example, I create this function:

void function(void)
{
    char buffer[5];
    strcpy(buffer, "ABCDEFGHIJK");
    printf("%s\n",buffer);
}

int main(int argc, char *argv[])
{
    defaultExceptionHandler();

    consoleDemoInit();
    function();

    printf("You shouldn't see this message.\n");

    while (1)
       swiWaitForVBlank();
}

Whenever I call it the ROM crashes, but not because of the thumb undefined instruction in the helper you've added.

I've built this ROM with:

LIBS := -lnds9d

CFLAGS := -fstack-protector-strong

@AntonioND AntonioND merged commit 04a74c7 into blocksds:master Jun 4, 2024
@AntonioND
Copy link
Member

I've merged this PR, but can you take a look at it whenever you have time? If you manage to get it working, add an example to "examples/debug" so that we can use it as reference.

@profi200
Copy link

profi200 commented Jun 4, 2024

Looking at your test there could be some stack variables in the way. The stack guard is the first one that goes on the stack on function call and you have to overwrite everything else that is also on the stack for this function.
Otherwise did you check the disassembly? If gcc recognizes that you are writing out of bounds it can optimize this out because it's undefined behavior. Worst case you have to make some inline assembly function that writes X bytes to sp.

@asiekierka
Copy link
Contributor Author

@AntonioND The exact example you've provided works perfectly for me, though. It crashes at the opcode location for __stack_chk_fail.

@AntonioND
Copy link
Member

Huh, indeed, your example works. I wonder what was wrong when I tried it...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants