Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion chapters/data/memory-security/drills/tasks/aslr/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# ASLR

Navigate to `chapters/data/memory-security/drills/tasks/aslr` and run `make skels` to generate the `support/` folder.
Navigate to the `aslr` directory in the lab archive (or `chapters/data/memory-security/drills/tasks/aslr` if you are working directly in the repository) and run `make skels` to generate the `support/` folder.
Then navigate to `support/src`.

Use the `Makefile.aslr` file to compile the `chapters/data/memory-security/drills/tasks/aslr/support/aslr.c` file:
Expand Down
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
# Bypassing the Stack Protector

Navigate to `chapters/data/memory-security/drills/tasks/bypassing-stack-protector` and run `make skels` to generate the `support/` folder.
Navigate to the `bypassing-stack-protector` directory in the lab archive (or `chapters/data/memory-security/drills/tasks/bypassing-stack-protector` if you are working directly in the repository) and run `make skels` to generate the `support/` folder.
Then navigate to `support/src`.

Inspect the `chapters/data/memory-security/drills/tasks/bypassing-stack-protector/support/stack_protector.c` source file.
Inspect the `bypassing-stack-protector/support/stack_protector.c` source file.
Compile the program and examine the object code.
Try to identify the canary value.
Using the `addr` variable, write 2 instructions: one that indexes `addr` to overwrite the canary with the correct value and one that indexes `addr` to overwrite the return address with the address of function `pawned()`.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,11 +1,9 @@
## Shellcode Executor

Navigate to `chapters/data/memory-security/drills/tasks/exec-shellcode` and run `make skels` to generate the `support/` folder.
Navigate to the `exec-shellcode` directory in the lab archive (or `chapters/data/memory-security/drills/tasks/exec-shellcode` if you are working directly in the repository) and run `make skels` to generate the `support/` folder.
Then navigate to `support/src`.

Navigate to the `chapters/data/memory-security/drills/tasks/exec-shellcode/support/` directory.

Your goal is to update the `src/exec-shellcode.s` source code file to be able to read and execute shellcodes from a given binary files.
Your goal is to update the `exec-shellcode.s` source code file to be able to read and execute shellcodes from a given binary files.
The program thus acts as a shellcode tester.

A [shellcode](https://cocomelonc.github.io/tutorial/2021/10/09/linux-shellcoding-1.html) is a small program that is commonly used in memory-related security exploits as a form of arbitrary code execution.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,9 +1,8 @@
# Wild Pointer Arithmetic Info Leak

Navigate to `chapters/data/memory-security/drills/tasks/pointer-arithmetic-leak` and run `make skels` to generate the `support/` folder.
Navigate to the `pointer-arithmetic-leak/` in the lab archive (or `chapters/data/memory-security/drills/tasks/pointer-arithmetic-leak` if you are working directly in the repository) and run `make skels` to generate the `support/` folder.
Then navigate to `support/src`.

Navigate to the `chapters/data/memory-security/drills/tasks/pointer-arithmetic-leak/support/` directory.
Open and analyze the `buff_leak.c` file.

The pointer `p` points to the stack.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
# Stack Protector

Navigate to `chapters/data/memory-security/drills/tasks/stack-protector` and run `make skels` to generate the `support/` folder.
Navigate to `stack-protector/` directory in the lab archive (or `chapters/data/memory-security/drills/tasks/stack-protector` if you are working directly in the repository) and run `make skels` to generate the `support/` folder.
Then navigate to `support/src`.

Comment the `-fno-stack-protector` switch from the `chapters/data/memory-security/drills/tasks/stack-protector/support/Makefile`, recompile and run the `bo_practice_write` executable.
Comment the `-fno-stack-protector` switch from `stack-protector/support/Makefile`, recompile and run the `bo_practice_write` executable.
Examine the binary with `objdump` and identify the instructions that set and test the canary.
Observe what happens when a buffer overflow occurs.

Expand Down
1 change: 1 addition & 0 deletions chapters/data/overview/reading/lab3.md
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
The contents of the lab are located in the [lab archive](https://github.com/cs-pub-ro/operating-systems/raw/refs/heads/lab-archives/Lab_3_Memory.zip) and in the [GitHub repository](https://github.com/cs-pub-ro/operating-systems).
1 change: 1 addition & 0 deletions chapters/data/overview/reading/lab4.md
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
The contents of the lab are located in the [lab archive](https://github.com/cs-pub-ro/operating-systems/raw/refs/heads/lab-archives/Lab_4_Investigate_Memory.zip) and in the [GitHub repository](https://github.com/cs-pub-ro/operating-systems).
1 change: 1 addition & 0 deletions chapters/data/overview/reading/lab5.md
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
The contents of the lab are located in the [lab archive](https://github.com/cs-pub-ro/operating-systems/raw/refs/heads/lab-archives/Lab_5_Memory_Security.zip) and in the [GitHub repository](https://github.com/cs-pub-ro/operating-systems).
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Allocating and Deallocating Memory

Navigate to the `chapters/data/process-memory/drills/tasks/alloc-size/support` directory.
Navigate to the `alloc-size/support/` directory from the lab archive (or `chapters/data/process-memory/drills/tasks/alloc-size/support` if you are working directly in the repository).

1. Use `pmap` to analyze the process address space for `ALLOC_SIZE_KB` initialized to `256`.
Notice the new memory areas and the difference between the use of `mmap` syscall and `brk` syscall.
Expand Down
2 changes: 1 addition & 1 deletion chapters/data/process-memory/drills/tasks/copy/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Memory Mapping

Navigate to the `chapters/data/process-memory/drills/tasks/copy/` directory, run `make skels` and open the `support/src` directory.
Navigate to the `copy/` directory from the lab archive (or `chapters/data/process-memory/drills/tasks/copy/` if you are working directly in the repository), run `make skels` and open the `support/src` directory.
Here you will find these files:

* `read_write_copy.c` in which you will implement copying with `read` / `write` syscalls
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Memory Regions

Enter the `chapters/data/process-memory/drills/tasks/memory-areas/support` directory.
Enter the `memory-areas/support/` directory in the lab archive (or `chapters/data/process-memory/drills/tasks/memory-areas/support` if you are working directly in the repository).
We investigate other programs.

1. The `hello.c` program prints out a message and then sleeps.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Modifying Memory Region Size

Navigate to the `chapters/data/process-memory/drills/tasks/modify-areas/support` directory.
Navigate to the `modify-areas/support/` directory in the lab archive (or `chapters/data/process-memory/drills/tasks/modify-areas/support` if you are working directly in the repository).

1. Comment out different parts of the `hello.c` program to notice differences in only specific areas (text, data, bss, heap, stack).

Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
## Page Mapper

Navigate to the `chapters/data/process-memory/drills/tasks/page-mapper/support` directory.
Navigate to the `page-mapper/support/` directory in the lab archive (or `chapters/data/process-memory/drills/tasks/page-mapper/support` if you are working directly in the repository).

Your goal is to update the `src/page_mapper.c` source code file to reserve virtual pages in the address space of the current process.
Use `mmap()` to reserve virtual pages.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Operator overloading

Navigate to the `chapters/data/process-memory/drills/tasks/reference-counting/support` directory.
Navigate to the `reference-counting/support/` directory in the lab archive (or `chapters/data/process-memory/drills/tasks/reference-counting/support` if you are working directly in the repository).
Analyze the `operators.d` file.
A `struct` is defined that also implements 4 special functions: a constructor, a copy constructor, an assignment operator and a destructor.
Each of these special functions may be called automatically by the compiler:
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Access Counter

Navigate to the `chapters/data/working-with-memory/drills/tasks/access-counter/support` directory.
Navigate to the `access-counter/` directory from the lab archive (or `chapters/data/working-with-memory/drills/tasks/access-counter/support` if you are working directly in the repository).

Your goal is to update the `src/access_counter.c` source code file to capture memory access exceptions (i.e. the `SIGSEGV` signal) and to update page permissions in order for the access to eventually succeed.
Use `mprotect` to update the protection of the pages in stages: read, write and then exec.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Memory Access

Navigate to the `chapters/data/working-with-memory/drills/tasks/memory-access/` directory, run `make skels`, and enter `support/src/`.
Navigate to the `memory-access/` directory from the lab archive (or `chapters/data/working-with-memory/drills/tasks/memory-access/` if you are running directly in the repository), run `make skels`, and enter `support/src/`.
Inspect the `mem_access.c` source file.

1. Describe each variable by completing its **(address, size, access rights)** tuple.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

For this practice item, you will need to identify the programming mistake that makes it possible to corrupt memory.

Navigate to the `chapters/data/working-with-memory/drills/tasks/memory-corruption/` folder, run `make skels` and enter `support/src/`.
Navigate to the `memory-corruption/` directory in the lab archive (or `chapters/data/working-with-memory/drills/tasks/memory-corruption/` if you are working directly in the repository) run `make skels` and enter `support/src/`.
Inspect the source file `segfault.c`.

1. What does the program do? (this could be a quiz in the final form)
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Memory Protection

Let's navigate to the `chapters/data/working-with-memory/drills/tasks/memory-protection/`, run `make skels` and enter the `support/src/` directory.
Let's navigate to the `memory-protection/` directory from the lab archive (or `chapters/data/working-with-memory/drills/tasks/memory-protection/` if you are working directly in the repository), run `make skels` and enter the `support/src/` directory.

Inspect the `mem_prot.c` source file.
The file uses different access types for the `data` variable and the `do_nothing` function.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# App Investigation

Enter the `chapters/software-stack/applications/drills/tasks/app-investigation/support/` folder and go through the practice items below.
Enter the `app-investigation` directory from the lab archive (or `chapters/software-stack/applications/drills/tasks/app-investigation/` if you are working directly in the repository), run `make skels` and go through the practice items below.
Select a binary executable application and a scripted application.

1. Use `ldd` on the two applications.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# High-Level Languages

Enter the `chapters/software-stack/high-level-languages/drills/tasks/high-level-lang/` folder, run `make skels`, then enter `spport/`
Enter the `high-level-lang/` directory from the lab archive (or `chapters/software-stack/high-level-languages/drills/tasks/high-level-lang/` if you are working directly in the repository), run `make skels`, then enter `spport/`
Then go through the practice items below.

1. Use `make` to create the `hello` executable from the `hello.go` file (a Go "Hello, World!"-printing program).
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Common Functions

Enter the `chapters/software-stack/libc/drills/tasks/common-functions/` folder, run `make skels`, then enter `support/`.
Enter the `common-functions/` directory in the lab archive (or `chapters/software-stack/libc/drills/tasks/common-functions/` if you are working directly in the repository), run `make skels`, then enter `support/`.
Go through the practice items below.

1. Update `os_string.c` and `os_string.h` to make available the `os_strcat()` function that performs the same string concatenation as `strcat()` from `libc`.
Expand Down
2 changes: 1 addition & 1 deletion chapters/software-stack/libc/drills/tasks/libc/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Libraries and libc

Enter the `chapters/software-stack/libc/libc/drills/tasks/` folder, run `make skels`, then enter `support/`.
Enter the `libc/support/` directory from the lab archive (or `chapters/software-stack/libc/libc/drills/tasks/support/` if you are working directly in the repository).
Now go through the practice items below.

1. Use `malloc()` and `free()` functions in the `memory.c` program.
Expand Down
1 change: 1 addition & 0 deletions chapters/software-stack/overview/reading/lab1.md
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
The contents of the lab are located in the [lab archive](https://github.com/cs-pub-ro/operating-systems/raw/refs/heads/lab-archives/Lab_1_Operating_System_Perspective.zip) and in the [GitHub repository](https://github.com/cs-pub-ro/operating-systems).
1 change: 1 addition & 0 deletions chapters/software-stack/overview/reading/lab2.md
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
The contents of the lab are located in the [lab archive](https://github.com/cs-pub-ro/operating-systems/raw/refs/heads/lab-archives/Lab_2_Library_Perspective.zip) and in the [GitHub repository](https://github.com/cs-pub-ro/operating-systems).
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# System Calls

Enter the `chapters/software-stack/system-calls/drills/tasks/basic-syscall/` folder.
Run `make` and then enter `chapters/software-stack/system-calls/drills/tasks/basic-syscall/support/` folder and go through the practice items below.
Enter the `basic-syscall/` directory of the extracted archive (or `chapters/software-stack/system-calls/drills/tasks/basic-syscall/` if you are working directly in the repository).
Run `make` and then enter `support/` folder and go through the practice items below.

For debugging, use `strace` to trace the system calls from your program and make sure the arguments are set right.

Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Library Calls vs System Calls

Enter the `chapters/software-stack/system-calls/drills/tasks/libcall-syscall/support/` folder and go through the practice items below.
Enter the `libcall-syscall/support/` directory from the extracted archive (or `chapters/software-stack/system-calls/drills/tasks/libcall-syscall/support/` if you are working directly in the repository) and go through the practice items below.

1. Check library calls and system calls for the `call2.c` file.
Use `ltrace` and `strace`.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# System Call Wrappers

Enter the `chapters/software-stack/system-calls/syscall-wrapper/drills/tasks/support/` folder and go through the practice items below.
Enter the `syscall-wrapper/` directory from the extracted archive (or `chapters/software-stack/system-calls/syscall-wrapper/drills/tasks/support/` if you are working directly in the repository) and run `make`, then go through the practice items below.

1. Update the files in the `support/` folder to make `read` system call available as a wrapper.
Make a call to the `read` system call to read data from standard input in a buffer.
Expand Down
5 changes: 5 additions & 0 deletions config.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ lab_structure:
- title: Lab 1 - Operating System Perspective
filename: lab1.md
content:
- reading/lab1.md
- tasks/basic-syscall.md
- tasks/syscall-wrapper.md
- tasks/libcall-syscall.md
Expand All @@ -25,6 +26,7 @@ lab_structure:
- title: Lab 2 - Library Perspective
filename: lab2.md
content:
- reading/lab2.md
- tasks/common-functions.md
- tasks/libc.md
- tasks/high-level-lang.md
Expand All @@ -37,6 +39,7 @@ lab_structure:
- title: Lab 3 - Memory
filename: lab3.md
content:
- reading/lab3.md
- tasks/memory-access.md
- tasks/memory-corruption.md
- tasks/memory-protection.md
Expand All @@ -48,6 +51,7 @@ lab_structure:
- title: Lab 4 - Investigate Memory
filename: lab4.md
content:
- reading/lab4.md
- tasks/alloc-size.md
- tasks/copy.md
- tasks/memory-areas.md
Expand All @@ -66,6 +70,7 @@ lab_structure:
- title: Lab 5 - Memory Security
filename: lab5.md
content:
- reading/lab5.md
- tasks/pointer-arithmetic-leak.md
- tasks/aslr.md
- tasks/stack-protector.md
Expand Down
6 changes: 6 additions & 0 deletions misc/lab-setup.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,12 @@

You can work on any Linux setup (native install, `WSL`, `VM`), but we strongly recommend you use the [`operating-systems` class VMs](https://cs-pub-ro.github.io/operating-systems/resources#virtual-machine).

## Laboratory archives

All the laboratories have archives with the work items.
**We recommend working with the provided archives instead of using the repository.**
If, however, you want to use the repository directly, you can find instructions below.

## Cloning the repository

If you haven't already cloned the repository, do so and you are ready to go:
Expand Down
Loading