Re: A Famous Security Bug

On 25/03/2024 14:11, Michael S wrote:

On Mon, 25 Mar 2024 13:26:01 +0100
David Brown <david.brown@hesbynett.no> wrote:
 

On 25/03/2024 12:16, Michael S wrote:

On Sun, 24 Mar 2024 23:43:32 +0100
David Brown <david.brown@hesbynett.no> wrote:

>
I could be  wrong here, of course.
 

>
It seems, you are.
  

>
It happens - and it was not unexpected here, as I said.  I don't have
all these compilers installed to test.
>
But it would be helpful if you had a /little/ more information.  If
you don't know why some compilers generate binaries that have memory
mapped at 0x400000, and others do not, fair enough.  I am curious,
but it's not at all important.
>

 I am not an expert, but it does not look like the problem is directly
related to compiler or linker. All 32-bit Windows compilers/linkers,

(I get the impression that at least some of the compilers in question are 64-bit, but I can't be sure, especially as Bart is using them on Windows while I mainly use Linux for development.)

including gcc, clang and MSVC, by default put symbol ___ImageBase at
address 4 MB. However loader relocates it to wherever it wants,
typically much higher.

OK.
Is this a kind of address randomisation thing?  That would make sense, since such randomisation makes various kinds of attacks a good deal harder, and hardening against attacks is something gcc and binutils (I'm guessing that's the linker involved here) take seriously.

I don't know for sure why loader does it to images generated by gcc,
clang and MSVC and does not do it to images generated by lccwin and
others, but I have an educated guess: most likely, these other compilers
link by default with an option similar to Microsoft's /Fixed
https://learn.microsoft.com/en-us/cpp/build/reference/fixed-fixed-base-address?view=msvc-170
 The option disables ASLR and thus can shorten app load time and make
performance just a little snappier. Still, I wouldn't make it default.
 

Maybe it makes things easier for some kinds of code generation?  It might reduce the need for position-independent code.
Most of my work is in small-systems embedded programming, where you do not normally have an MMU and addresses tend to be fixed.  (There are occasions when you want to be able to load code at different addresses, but then you need to make sure it is generated as position-independent.)   So while I know more than most programmers about linking on those systems, it is in a specific area of programming.  It's not something I have looked at for Windows at all.

To get similar behavior with [32-bit] MSVC user can specify '/linker
/fixed' on the command line. I don't know how to do it with gcc variant
supplied with msys2. But, I'd guess, if you google for long enough, you
can find it.
 

It is presumably a linker flag, rather than a gcc flag.  And I don't know if Bart's gcc setup is using the common binutils linker, or something else.
Thanks for the information, anyway.