>> Relocation section '.rela.plt' at offset 0x4b8 contains 1 entry: >> Offset Info Type Sym. Value Sym. Name + Addend >> 000000404018 000200000007 R_X86_64_JUMP_SLO 0000000000000000 puts@GLIBC_2.2.5 + 0 As we can see the offset from relocation at index 0 points to GOT[3].","breadcrumbs":"Development » Dynamic Linking (x86_64)","id":"193","title":"Dynamic Linking (x86_64)"},"194":{"body":"x86_64 arm64","breadcrumbs":"Arch","id":"194","title":"Arch"},"195":{"body":"keywords: x86_64, x86, abi 64bit synonyms: x86_64, x64, amd64, intel 64 32bit synonyms: x86, ia32, i386 ISA type: CISC Endianness: little","breadcrumbs":"Arch » x86_64","id":"195","title":"x86_64"},"196":{"body":"","breadcrumbs":"Arch » Registers","id":"196","title":"Registers"},"197":{"body":"bytes\n[7:0] [3:0] [1:0] [1] [0] desc\n----------------------------------------------------------\nrax eax ax ah al accumulator\nrbx ebx bx bh bl base register\nrcx ecx cx ch cl counter\nrdx edx dx dh dl data register\nrsi esi si - sil source index\nrdi edi di - dil destination index\nrbp ebp bp - bpl base pointer\nrsp esp sp - spl stack pointer\nr8-15 rNd rNw - rNb","breadcrumbs":"Arch » General purpose register","id":"197","title":"General purpose register"},"198":{"body":"bytes\n[7:0] [3:0] [1:0] desc\n---------------------------------------------------\nrflags eflags flags flags register\nrip eip ip instruction pointer","breadcrumbs":"Arch » Special register","id":"198","title":"Special register"},"199":{"body":"rflags\nbits desc\n-----------------------------\n[11] OF overflow flag\n[10] DF direction flag [7] SF sign flag [6] ZF zero flag [4] AF auxiliary carry flag [2] PF parity flag [0] CF carry flag","breadcrumbs":"Arch » FLAGS register","id":"199","title":"FLAGS register"},"2":{"body":"","breadcrumbs":"Tools » zsh(1)","id":"2","title":"zsh(1)"},"20":{"body":"The getopts builtin uses following global variables: OPTARG, value of last option argument OPTIND, index of the next argument to process (user must reset) OPTERR, display errors if set to 1 getopts [] specifies the names of supported options, eg f:c f: means -f option with an argument c means -c option without an argument specifies a variable name which getopts fills with the last parsed option argument optionally specify argument string to parse, by default getopts parses $@","breadcrumbs":"Tools » Argument parsing with getopts","id":"20","title":"Argument parsing with getopts"},"200":{"body":"movw [rax], rbx // save val in rbx at [rax]\nmovw [imm], rbx // save val in rbx at [imm]\nmovw rax, [rbx+4*rcx] // load val at [rbx+4*rcx] into rax rip relative addressing: lea rax, [rip+.my_str] // load addr of .my_str into rax\n...\n.my_str:\n.asciz \"Foo\"","breadcrumbs":"Arch » Addressing","id":"200","title":"Addressing"},"201":{"body":"Explicitly specify size of the operation. mov byte ptr [rax], 0xff // save 1 byte(s) at [rax]\nmov word ptr [rax], 0xff // save 2 byte(s) at [rax]\nmov dword ptr [rax], 0xff // save 4 byte(s) at [rax]\nmov qword ptr [rax], 0xff // save 8 byte(s) at [rax]","breadcrumbs":"Arch » Size directives","id":"201","title":"Size directives"},"202":{"body":"","breadcrumbs":"Arch » SysV x86_64 ABI","id":"202","title":"SysV x86_64 ABI"},"203":{"body":"Integer/Pointer arguments reg arg\n-----------\nrdi 1\nrsi 2\nrdx 3\nrcx 4\nr8 5\nr9 6 Floating point arguments reg arg\n-----------\nxmm0 1 .. ..\nxmm7 8 Additional arguments are passed on the stack. Arguments are pushed right-to-left (RTL), meaning next arguments are closer to current rsp.","breadcrumbs":"Arch » Passing arguments to functions","id":"203","title":"Passing arguments to functions"},"204":{"body":"Integer/Pointer return values reg size\n-----------------\nrax 64 bit\nrax+rdx 128 bit Floating point return values: reg size\n-------------------\nxmm0 64 bit\nxmm0+xmm1 128 bit","breadcrumbs":"Arch » Return values from functions","id":"204","title":"Return values from functions"},"205":{"body":"Caller must save these registers if they should be preserved across function calls. rax rcx rdx rsi rdi rsp r8 - r11","breadcrumbs":"Arch » Caller saved registers","id":"205","title":"Caller saved registers"},"206":{"body":"Caller can expect these registers to be preserved across function calls. Callee must must save these registers in case they are used. rbx rbp r12 – r15","breadcrumbs":"Arch » Callee saved registers","id":"206","title":"Callee saved registers"},"207":{"body":"grows downwards frames aligned on 16 byte boundary Hi ADDR | +------------+ | | prev frame | | +------------+ <--- 16 byte aligned (X & ~0xf) | [rbp+8] | saved RIP | | [rbp] | saved RBP | | [rbp-8] | func stack | | | ... | v +------------+\nLo ADDR","breadcrumbs":"Arch » Stack","id":"207","title":"Stack"},"208":{"body":"prologue push rbp // save caller base pointer\nmov rbp, rsp // save caller stack pointer epilogue mov rsp, rbp // restore caller stack pointer\npop rbp // restore caller base pointer Equivalent to leave instruction.","breadcrumbs":"Arch » Function prologue & epilogue","id":"208","title":"Function prologue & epilogue"},"209":{"body":"Small assembler skeleton, ready to use with following properties: use raw Linux syscalls (man 2 syscall for ABI) no C runtime (crt) gnu assembler gas intel syntax # file: greet.s .intel_syntax noprefix .section .text, \"ax\", @progbits .global _start\n_start: mov rdi, 1 # fd lea rsi, [rip + greeting] # buf mov rdx, [rip + greeting_len] # count mov rax, 1 # write(2) syscall nr syscall mov rdi, 0 # exit code mov rax, 60 # exit(2) syscall nr syscall .section .rdonly, \"a\", @progbits\ngreeting: .asciz \"Hi ASM-World!\\n\"\ngreeting_len: .int .-greeting Syscall numbers are defined in /usr/include/asm/unistd.h. To compile and run: > gcc -o greet greet.s -nostartfiles -nostdlib && ./greet\nHi ASM-World!","breadcrumbs":"Arch » ASM skeleton","id":"209","title":"ASM skeleton"},"21":{"body":"#!/bin/bash\nfunction parse_args() { while getopts \"f:c\" PARAM; do case $PARAM in f) echo \"GOT -f $OPTARG\";; c) echo \"GOT -c\";; *) echo \"ERR: print usage\"; exit 1;; esac done # users responsibility to reset OPTIND OPTIND=0\n} parse_args -f xxx -c\nparse_args -f yyy","breadcrumbs":"Tools » Example","id":"21","title":"Example"},"210":{"body":"SystemV AMD64 ABI AMD64 Vol1: Application Programming AMD64 Vol2: System Programming AMD64 Vol3: General-Purpose & System Instructions X86_64 Cheat-Sheet Intel 64 Vol1: Basic Architecture Intel 64 Vol2: Instruction Set Reference Intel 64 Vol3: System Programming Guide GNU Assembler GNU Assembler Directives","breadcrumbs":"Arch » References","id":"210","title":"References"},"211":{"body":"keywords: arm64, aarch64, abi 64bit synonyms: arm64, aarch64 ISA type: RISC Endianness: little, big","breadcrumbs":"Arch » arm64","id":"211","title":"arm64"},"212":{"body":"","breadcrumbs":"Arch » Registers","id":"212","title":"Registers"},"213":{"body":"bytes\n[7:0] [3:0] desc\n---------------------------------------------\nx0-x28 w0-w28 general purpose registers\nx29 w29 frame pointer (FP)\nx30 w30 link register (LR)\nsp wsp stack pointer (SP)\npc program counter (PC)\nxzr wzr zero register Write to wN register clears upper 32bit.","breadcrumbs":"Arch » General purpose registers","id":"213","title":"General purpose registers"},"214":{"body":"bytes\n[7:0] desc\n---------------------------------------------\nsp_el0 stack pointer EL0 sp_el1 stack pointer EL1\nelr_el1 exception link register EL1\nspsr_el1 saved process status register EL1 sp_el2 stack pointer EL2\nelr_el2 exception link register EL2\nspsr_el2 saved process status register EL2 sp_el3 stack pointer EL3\nelr_el3 exception link register EL3\nspsr_el3 saved process status register EL3","breadcrumbs":"Arch » Special registers per EL","id":"214","title":"Special registers per EL"},"215":{"body":"","breadcrumbs":"Arch » Addressing","id":"215","title":"Addressing"},"216":{"body":"ldr x0, [x1] // x0 = [x1]\nldr x0, [x1, 8] // x0 = [x1 + 8]\nldr x0, [x1, x2, lsl #3] // x0 = [x1 + (x2<<3)]\nldr x0, [x1, w2, stxw] // x0 = [x1 + sign_ext(w2)]\nldr x0, [x1, w2, stxw #3] // x0 = [x1 + (sign_ext(w2)<<3)] Shift amount can either be 0 or log2(access_size_bytes). Eg for 8byte access it can either be {0, 3}.","breadcrumbs":"Arch » Offset","id":"216","title":"Offset"},"217":{"body":"ldr x0, [x1, 8]! // pre-inc : x1+=8; x0 = [x1]\nldr x0, [x1], 8 // post-inc: x0 = [x1]; x1+=8","breadcrumbs":"Arch » Index","id":"217","title":"Index"},"218":{"body":"ldp x1, x2, [x0] // x1 = [x0]; x2 = [x0 + 8]\nstp x1, x2, [x0] // [x0] = x1; [x0 + 8] = x2","breadcrumbs":"Arch » Pair access","id":"218","title":"Pair access"},"219":{"body":"","breadcrumbs":"Arch » Procedure Call Standard ARM64 ( aapcs64 )","id":"219","title":"Procedure Call Standard ARM64 ( aapcs64 )"},"22":{"body":"Bash supports regular expression matching with the binary operator =~. The match results can be accessed via the $BASH_REMATCH variable: ${BASH_REMATCH[0]} contains the full match ${BASH_REMATCH[1]} contains match of the first capture group INPUT='title foo : 1234'\nREGEX='^title (.+) : ([0-9]+)$'\nif [[ $INPUT =~ $REGEX ]]; then echo \"${BASH_REMATCH[0]}\" # title foo : 1234 echo \"${BASH_REMATCH[1]}\" # foo echo \"${BASH_REMATCH[2]}\" # 1234\nfi Caution : When specifying a regex in the [[ ]] block directly, quotes will be treated as part of the pattern. [[ $INPUT =~ \"foo\" ]] will match against \"foo\" not foo!","breadcrumbs":"Tools » Regular Expressions","id":"22","title":"Regular Expressions"},"220":{"body":"Integer/Pointer arguments reg arg\n-----------\nx0 1\n.. ..\nx7 8 Additional arguments are passed on the stack. Arguments are pushed right-to-left (RTL), meaning next arguments are closer to current sp. void take(..., int a9, int a10); | | | ... | Hi | +-->| a10 | | +---------->| a9 | <-SP | +-----+ v | ... | Lo","breadcrumbs":"Arch » Passing arguments to functions","id":"220","title":"Passing arguments to functions"},"221":{"body":"Integer/Pointer return values reg size\n-----------------\nx0 64 bit","breadcrumbs":"Arch » Return values from functions","id":"221","title":"Return values from functions"},"222":{"body":"x19 - x28 SP","breadcrumbs":"Arch » Callee saved registers","id":"222","title":"Callee saved registers"},"223":{"body":"grows downwards sp must be 16byte aligned when used to access memory for r/w sp must be 16byte aligned on public interface interfaces","breadcrumbs":"Arch » Stack","id":"223","title":"Stack"},"224":{"body":"linked list of stack-frames each frame links to the frame of its caller by a frame record a frame record is described as a (FP,LR) pair x29 (FP) must point to the frame record of the current stack-frame +------+ Hi | 0 | frame0 | +->| 0 | | | | ... | | | +------+ | | | LR | frame1 | +--| FP |<-+ | | ... | | | +------+ | | | LR | | current |\nx29 ->| FP |--+ frame v | ... | Lo end of the frame chain is indicated by following frame record (0,-) location of the frame record in the stack frame is not specified","breadcrumbs":"Arch » Frame chain","id":"224","title":"Frame chain"},"225":{"body":"prologue sub sp, sp, 16\nstp x29, x30, [sp] // [sp] = x29; [sp + 8] = x30\nmov x29, sp // FP points to frame record epilogue ldp x29, x30, [sp] // x29 = [sp]; x30 = [sp + 8]\nadd sp, sp, 16\nret","breadcrumbs":"Arch » Function prologue & epilogue","id":"225","title":"Function prologue & epilogue"},"226":{"body":"Small assembler skeleton, ready to use with following properties: use raw Linux syscalls (man 2 syscall for ABI) no C runtime (crt) gnu assembler gas // file: greet.S #include // syscall NRs .arch armv8-a .section .text, \"ax\", @progbits .balign 4 // align code on 4byte boundary .global _start\n_start: mov x0, 2 // fd ldr x1, =greeting // buf ldr x2, =greeting_len // &len ldr x2, [x2] // len mov w8, __NR_write // write(2) syscall svc 0 mov x0, 0 // exit code mov w8, __NR_exit // exit(2) syscall svc 0 .balign 8 // align data on 8byte boundary .section .rodata, \"a\", @progbits\ngreeting: .asciz \"Hi ASM-World!\\n\"\ngreeting_len: .int .-greeting man gcc: file.S assembler code that must be preprocessed. To cross-compile and run: > aarch64-linux-gnu-g++ -o greet greet.S -nostartfiles -nostdlib \\ -Wl,--dynamic-linker=/usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 \\ && qemu-aarch64 ./greet\nHi ASM-World! Cross-compiling on Ubuntu 20.04, paths might differ on other distributions. Compiling natively on arm64, specifying the dynamic linker should not be required.","breadcrumbs":"Arch » ASM skeleton","id":"226","title":"ASM skeleton"},"227":{"body":"Procedure Call Standard ARM64 ARMv8 Programmer's Guide GNU Assembler GNU Assembler Directives","breadcrumbs":"Arch » References","id":"227","title":"References"},"23":{"body":"The complete builtin is used to interact with the completion system. complete # print currently installed completion handler\ncomplete -F # install as completion handler for \ncomplete -r # uninstall completion handler for Variables available in completion functions: # in\n$1 # \n$2 # current word\n$3 # privous word COMP_WORDS # array with current command line words\nCOMP_CWORD # index into COMP_WORDS with current cursor position # out\nCOMPREPLY # array with possible completions The compgen builtin is used to generate possible matches by comparing word against words generated by option. compgen

qemu(1)

All the examples & notes use qemu-system-x86_64 but in most cases +this can be swapped with the system emulator for other architectures.

Keybindings

Ctrl+Alt+g         release mouse capture from VM
+
+Ctrl+Alt+1         switch to display of VM
+Ctrl+Alt+2         switch to qemu monitor
+

VM config snippet

Following command-line gives a good starting point to assemble a VM:

qemu-system-x86_64                              \
+        -cpu host -enable-kvm -smp 4            \
+        -m 8G                                   \
+        -vga virtio -display sdl,gl=on          \
+        -boot menu=on                           \
+        -cdrom <iso>                            \
+        -hda <disk>                             \
+        -device qemu-xhci,id=xhci               \
+        -device usb-host,bus=xhci.0,vendorid=0x05e1,productid=0x0408,id=capture-card
+

CPU & RAM

-cpu host emulate host CPU in guest VM
-enable-kvm use KVM instead software models (requires KVM on host machine)
-smp <N> number of guest CPUs

+
List available CPUs qemu-system-x86_64 -cpu help.
+

-m 8G size of guest RAM

Graphic & Display

-vga virtio use virtio as 3D video graphic accelerator (requires virgl in guest)
-display sdl,gl=on use sdl window and enable openGL context

Boot Menu

-boot menu=on enables boot menu to select boot device (enter with ESC)

Block devices

-cdrom <iso> attach cdrom drive with iso to a VM
-hda <disk> attach disk drive to a VM
-drive file=<file>,format=qcow2 generic way to configure & attach a drive to a VM

Create a disk with `qemu-img`

To create a qcow2 disk (qemu copy-on-write) of size 10G:

qemu-img create -f qcow2 disk.qcow2 10G
+

The disk does not contain any partitions or a partition table. +We can format the disk from within the guest as following example:

# Create `gpt` partition table.
+sudo parted /dev/sda mktable gpt
+
+# Create two equally sized primary partitions.
+sudo parted /dev/sda mkpart primary 0% 50%
+sudo parted /dev/sda mkpart primary 50% 100%
+
+# Create filesystem on each partition.
+sudo mkfs.ext3 /dev/sda1
+sudo mkfs.ext4 /dev/sda2
+
+lsblk -f /dev/sda
+  NAME   FSTYPE LABEL UUID FSAVAIL FSUSE% MOUNTPOINT
+  sda
+  ├─sda1 ext3         ....
+  └─sda2 ext4         ....
+

USB

Host Controller

-device qemu-xhci,id=xhci add XHCI USB controller to the VM (supports USB 3.0, 2.0, 1.1). id=xhci creates a usb bus named xhci.

USB Device

-device usb-host,bus=xhci.0,vendorid=0x05e1,productid=0x0408 pass-through USB device from host identified by vendorid & productid and attach to usb bus xhci.0 (defined with controller id)

References

+ +

Notes