ASLR

General FreeBASIC programming questions.
deltarho[1859]
Posts: 2698
Joined: Jan 02, 2017 0:34
Location: UK

Re: ASLR

Postby deltarho[1859] » Oct 08, 2019 16:44

svraldez wrote:using the compiler and linker options that caused your app to crash

The one which saw Encrypternet close down straight away was
"-gen gcc -Wc -O2,-fpie -Wl -pie,-dynamicbase,-highentropyva"
and that beviour has not changed.

Your [edit] mentioned
-gen gcc -Wc -fPIE,-pie -Wl -dynamicbase
but I don ot know why because that simply did not work, ie no ASLR,
and that behaviour has not changed either.

The 9.2 that I have is dated 20190929 so I should imagine that they do not have ASLR enabled in their PE headers.

@José
There are differences because PB ...

Sounds good. Image

@All

I find myself a little downhearted now and wish that I had not seen the post at PowerBASIC about ASLR. When writing security code we need to be up to our armpits with all the security that an OS can offer. Since Encrypternet uses AES, RSA and ECDSA both DEP and ASLR should be embraced but, as we are right now, FreeBASIC cannot provide that, only DEP. This is a massive loss of brownie points for FreeBASIC and I am now considering abandoning it for cryptographic work, my main hobby after coding in general. PowerBASIC plus José's headers, which has CWindow.inc for high dpi aware code, can give me DEP and ASLR as well. The cryptographic departure is a logical move. Image
srvaldez
Posts: 2550
Joined: Sep 25, 2005 21:54

Re: ASLR

Postby srvaldez » Oct 08, 2019 16:50

@deltarho[1859]
stick around just a bit longer, let me build FB with the work-in-progress gcc-10 and see if it works, I will also build FB using gcc-9.2.0, who knows it might work
deltarho[1859]
Posts: 2698
Joined: Jan 02, 2017 0:34
Location: UK

Re: ASLR

Postby deltarho[1859] » Oct 08, 2019 17:01

I am not departing FreeBASIC, I might come across a PRNG to give PCG32II and MsWs a run for their money. FreeBASIC is much better for developing PRNG's than PowerBASIC. Cryptographic work, as I have mentioned, is a different story. I will, of course, try any builds that you make, srvaldez - lets face it, who the hell else will? Image

My SetCompilerSwitches is getting a workout that I didn't expect to see - it now covers a third of my 1080 screen height and I did not expect to see the width it has grown to either.
srvaldez
Posts: 2550
Joined: Sep 25, 2005 21:54

Re: ASLR

Postby srvaldez » Oct 08, 2019 17:38

@deltarho[1859]
give this a try fb1.07.1-win64-gcc10-20191006
MrSwiss
Posts: 3636
Joined: Jun 02, 2013 9:27
Location: Switzerland

Re: ASLR

Postby MrSwiss » Oct 08, 2019 18:10

@srvaldez,

you may want to change the /inc/fbc-int/array.bi, to the correct version here:
array.bi
The one currently there (all the 1.07.1 versions), is a other, older version ...
srvaldez
Posts: 2550
Joined: Sep 25, 2005 21:54

Re: ASLR

Postby srvaldez » Oct 08, 2019 18:14

thanks MrSwiss
deltarho[1859]
Posts: 2698
Joined: Jan 02, 2017 0:34
Location: UK

Re: ASLR

Postby deltarho[1859] » Oct 08, 2019 18:21

@srvaldez

From one of José's quotes we have: "Windows executables produced by mingw-w64 have the relocations table stripped from them by default."

So, what are hoping for with your 10.0 build?

Anyway, I tried this:

-gen gcc -Wc -O2 -Wl -fpie,-shared,-pie,-dynamicbase,-highentropyva

It is the only one which makes sense to but I'm getting '-f may not be used without -shared'. There is no point in removing -fpie and -pie because without them we are guaranteed no ASLR, and they are both -Wl related and not -Wc related; they are ignored if used with -Wc.

I reordered using:
-gen gcc -Wc -O2 -Wl -shared,-fpie,-pie,-dynamicbase,-highentropyva and still got '-f may not be used without -shared'.

On second thoughts 10.0 maybe producing PIE, for all that I know, so I tried:
-gen gcc -Wc -O2 -Wl -dynamicbase,-highentropyva
No error, no warnings and no ASLR but with DEP Enabled(permanent) and ASLR with Bottom-Up, Force-Relocate and no mention of high entropy.
Last edited by deltarho[1859] on Oct 08, 2019 18:28, edited 1 time in total.
srvaldez
Posts: 2550
Joined: Sep 25, 2005 21:54

Re: ASLR

Postby srvaldez » Oct 08, 2019 18:28

try -gen gcc -Wc -O2 -Wl -fPIE,-shared,-pie,-dynamicbase,-highentropyva
you need to ucase PIE as in fPIE
deltarho[1859] wrote:@srvaldez
So, what are hoping for with your 10.0 build?

I added -fPIE -pie to the CFLASG so the fb libraries are built with that option
deltarho[1859]
Posts: 2698
Joined: Jan 02, 2017 0:34
Location: UK

Re: ASLR

Postby deltarho[1859] » Oct 08, 2019 18:42

I tried -gen gcc -Wc -O2 -Wl -fPIE,-shared,-PIE,-dynamicbase,-highentropyva and got unrecognized option '-PIE' and an invitation to use --help.
I tried -gen gcc -Wc -O2 -Wl -fPIE,-shared,-pie,-dynamicbase,-highentropyva and got '-f may not be used without -shared'

srvaldez wrote:I added -fPIE -pie to the CFLASG so the fb libraries are built with that option

But they are not if "the relocations table stripped from them by default."

fPIE and PIE aren't even mentioned in any case nor is the word relocate

--help:

Code: Select all

usage: fbc [options] <input files>
input files:
  *.a = static library, *.o = object file, *.bas = source
  *.rc = resource script, *.res = compiled resource (win32)
  *.xpm = icon resource (*nix/*bsd)
options:
  @<file>          Read more command line arguments from a file
  -a <file>        Treat file as .o/.a input file
  -arch <type>     Set target architecture (default: 486)
  -asm att|intel   Set asm format (-gen gcc|llvm, x86 or x86_64 only)
  -b <file>        Treat file as .bas input file
  -c               Compile only, do not link
  -C               Preserve temporary .o files
  -d <name>[=<val>]  Add a global #define
  -dll             Same as -dylib
  -dylib           Create a DLL (win32) or shared library (*nix/*BSD)
  -e               Enable runtime error checking
  -earray          Enable array bounds checking
  -eassert         Enable assert() and assertwarn() checking
  -edebug          Enable __FB_DEBUG__
  -edebuginfo      Add debug info
  -elocation       Enable error location reporting
  -enullptr        Enable null-pointer checking
  -ex              -e plus RESUME support
  -exx             -ex plus array bounds/null-pointer checking
  -export          Export symbols for dynamic linkage
  -forcelang <name>  Override #lang statements in source code
  -fpmode fast|precise  Select floating-point math accuracy/speed
  -fpu x87|sse     Set target FPU
  -g               Add debug info, enable __FB_DEBUG__, and enable assert()
  -gen gas         Select GNU gas assembler backend
  -gen gcc         Select GNU gcc C backend
  -gen llvm        Select LLVM backend
  [-]-help         Show this help output
  -i <path>        Add an include file search path
  -include <file>  Pre-#include a file for each input .bas
  -l <name>        Link in a library
  -lang <name>     Select FB dialect: fb, deprecated, fblite, qb
  -lib             Create a static library
  -m <name>        Specify main module (default if not -c: first input .bas)
  -map <file>      Save linking map to file
  -maxerr <n>      Only show <n> errors
  -mt              Use thread-safe FB runtime
  -nodeflibs       Do not include the default libraries
  -noerrline       Do not show source context in error messages
  -noobjinfo       Do not read/write compile-time info from/to .o and .a files
  -nostrip         Do not strip symbol information from the output file
  -o <file>        Set .o (or -pp .bas) file name for prev/next input file
  -O <value>       Optimization level (default: 0)
  -p <path>        Add a library search path
  -pic             Generate position-independent code (non-x86 Unix shared libs)
  -pp              Write out preprocessed input file (.pp.bas) only
  -prefix <path>   Set the compiler prefix path
  -print host|target  Display host/target system name
  -print fblibdir  Display the compiler's lib/ path
  -print x         Display output binary/library file name (if known)
  -print sha-1     Display compiler's source code commit sha-1 (if known)
  -profile         Enable function profiling
  -r               Write out .asm/.c/.ll (-gen gas/gcc/llvm) only
  -rr              Write out the final .asm only
  -R               Preserve temporary .asm/.c/.ll/.def files
  -RR              Preserve the final .asm file
  -s console|gui   Select win32 subsystem
  -showincludes    Display a tree of file names of #included files
  -static          Prefer static libraries over dynamic ones when linking
  -strip           Omit all symbol information from the output file
  -t <value>       Set .exe stack size in kbytes, default: 1024 (win32/dos)
  -target <name>   Set cross-compilation target
  -title <name>    Set XBE display title (xbox)
  -v               Be verbose
  -vec <n>         Automatic vectorization level (default: 0)
  [-]-version      Show compiler version
  -w all|pedantic|<n>  Set min warning level: all, pedantic or a value
  -Wa <a,b,c>      Pass options to 'as'
  -Wc <a,b,c>      Pass options to 'gcc' (-gen gcc) or 'llc' (-gen llvm)
  -Wl <a,b,c>      Pass options to 'ld'
  -x <file>        Set output executable/library file name
  -z gosub-setjmp  Use setjmp/longjmp to implement GOSUB
  -z valist-as-ptr Use pointer expressions to implement CVA_*() macros
Josep Roca
Posts: 501
Joined: Sep 27, 2016 18:20
Location: Valencia, Spain

Re: ASLR

Postby Josep Roca » Oct 08, 2019 18:48

Why are you using -PIE? He has posted -pie. The ucased PIE is in -fPIE.
srvaldez
Posts: 2550
Joined: Sep 25, 2005 21:54

Re: ASLR

Postby srvaldez » Oct 08, 2019 18:54

I would try -gen gcc -Wc -O2,-fPIE,-pie -Wl -shared,-dynamicbase,-highentropyva
deltarho[1859]
Posts: 2698
Joined: Jan 02, 2017 0:34
Location: UK

Re: ASLR

Postby deltarho[1859] » Oct 08, 2019 19:01

OK and got a message from Windows with no title. The message was: "This app can't run on your PC."

I muttered "Whose PC do you recommend then?"
srvaldez
Posts: 2550
Joined: Sep 25, 2005 21:54

Re: ASLR

Postby srvaldez » Oct 08, 2019 19:01

@MrSwiss
I tried your include but when I run Unittest I get the error
fbc-int\array.bas(36) error 42: Variable not declared, fb_ArrayGetDesc in 'dim ap1 as FBARRAY ptr = fb_ArrayGetDesc( a1() )'

I changed the include to

Code: Select all

#ifndef __FBC_INT_ARRAY_BI__
#define __FBC_INT_ARRAY_BI__

# if __FB_LANG__ = "fb"
namespace FBC
# endif

'' declarations must follow ./src/rtlib/fb_array.h

const FB_MAXDIMENSIONS as integer = 8

type FBARRAYDIM
   dim as uinteger elements     '' number of elements
   dim as integer lbound        '' dimension lower bound
   dim as integer ubound        '' dimension upper bound
end type

type FBARRAY
   dim as any ptr index_ptr     '' @array(0, 0, 0, ... )
   dim as any ptr base_ptr      '' start of memory at array lowest bounds
   dim as uinteger size         '' byte size of allocated contents
   dim as uinteger element_len  '' byte size of single element
   dim as uinteger dimensions   '' number of dimensions

   '' take care with number of dimensions; fbc may allocate
   '' a smaller descriptor with fewer than FB_MAXDIMENSIONS
   '' in dimTb() if it is known at compile time that they
   '' are never needed.  Always respect number of
   '' dimensions when accessing dimTb()

   dim as FBARRAYDIM dimTb(0 to FB_MAXDIMENSIONS-1)
end type

extern "rtlib"
   declare function fb_ArrayGetDesc alias "fb_ArrayGetDesc" _
        ( array() as any ) as FBC.FBARRAY ptr
end extern

# if __FB_LANG__ = "fb"
end namespace
# endif

#EndIf  ' __FBC_INT_ARRAY_BI__

this is while building the 32-bit version, I did not rebuild FB with that include but it will be in the 64-bit version
srvaldez
Posts: 2550
Joined: Sep 25, 2005 21:54

Re: ASLR

Postby srvaldez » Oct 08, 2019 19:03

how about -gen gcc -Wc -O2,-fPIE,-pie -Wl -dynamicbase
deltarho[1859]
Posts: 2698
Joined: Jan 02, 2017 0:34
Location: UK

Re: ASLR

Postby deltarho[1859] » Oct 08, 2019 19:13

OK, same as above No errors, no warnings and no ASLR but with DEP Enabled(permanent) and ASLR with Bottom-Up, Force-Relocate.

We are now just shuffling cards in the hope that the Ace of Spades rises to the top.

Return to “General”

Who is online

Users browsing this forum: No registered users and 13 guests