Consider the following x86-64 assembly snippet in AT&T syntax:

movq $0x400000, %rax
movq $0x480, %rbx
movq $0x100, %rcx
movb (%rax, %rbx), %cl
addq $1, %rcx

or the same snippet rewritten in Intel syntax:

mov    rax,0x400000
mov    rbx,0x480
mov    rcx,0x100
mov    cl,BYTE PTR [rax+rbx*1]
add    rcx,0x1

After this runs the value of %rcx will be equal to _______?

In x86-64, there are at least two ways to encode addl %ecx, %eax (Intel syntax: add EAX, ECX). One is 01 c8 (writing as a list of byte values in hexadecimal). What is another?

(You may want to refer to the Intel manuals' reference for the add instruction: encoding summary or page 133 135 [corrected late 14 Feb] of this PDF.)

In lecture, we discussed how Vienna edited its code and data in memory before copying it into an executable to account for each executable having Vienna at a different location (depending on the size of the executable).

We mentioned that some of these modifications could have been avoided by replacing assembly instructions that encode an address directly with ones that encode an address relative to the current address. This would have further simplified Vienna's infection code.

Which of the following modifications to code and data that Vienna makes (to customize itself for a particular executable) could have been avoided using this strategy? Select all that apply.

Each of the following are features of ELF executables. Which of them would prevent Vienna's strategy of appending its code to the executable file and adding a jump to the executable to that code from working on an ELF executable (without Vienna doing substantial additional work to "fix" the executable file)? Select all that apply.

We mentioned several techniques in lecture by which virus-like malware can embed itself in executables.

Which, if any, of the following techniques would likely be detected by anti-virus software that checked whether file lengths of executables changed? (In the options below, a segment refers to something like a ELF segment, like is specified by a LOAD operation in an ELF program header.) Select all that apply.

In lecture we mentioned that the CIH virus inserted its part of its code into "cavities" it found in an executable, and then had some code it inserted reassemble that code in memory and jump to the reassembled code. Which, if any, of the following were advantages of this approach over jumping to the location of the cavities? Select all that apply.

We discussed in lecture how executables often contain unused space. Probably a compiler and/or linker could avoid this unused space. Which, if any, of the following would be likely properties of the resulting executable (when compared to an executable generated without avoiding unused space)? Select all that apply.

Suppose a Linux program set one of the entries of its global offset table to point to a function foo while it was running. Which of the following would be likely outcomes of this? Select all that apply.

Suppose a virus wanted to edit a dynamic linking stub like

0000000000001050 <puts@plt>:
    1050:       f3 0f 1e fa             endbr64 
    1054:       f2 ff 25 75 2f 00 00    bnd jmpq *0x2f75(%rip)        # 3fd0 <puts@GLIBC_2.2.5>

(or in Intel syntax):

0000000000001050 <puts@plt>:
    1050:       f3 0f 1e fa             endbr64 
    1054:       f2 ff 25 75 2f 00 00    bnd jmp [RIP + 0x2f75]        # 3fd0 <puts@GLIBC_2.2.5>

so that calls to puts@plt would call the virus code stealthily.

If it replaced the jmpq instruction with a call to the virus code and make it unlikely that the virus would be noticed, then which would be the best way (of the choices below) to end the virus code?

We mentioned in lecture that some malware uses stealth or rootkit-style techniques in an attempt to remain hidden from antimalware software and/or system administrators. Suppose, as part of this stealth strategy, such a malware overrode the operating system's function for listing the contents of directories. Which of the following would be the most likely behavior of the overriden function?

Sometimes malware computes a hash of its own machine code and data and compares it to a stored value. In which of the following circumstances would this check likely fail? Select all that apply.

Which of the following would be the most useful information that might be leaked by an information leak vulnerability for an attacker attempting to perform a buffer overflow despite stack canaries?

Consider the following C function ReadAndProcess:

void ReadAndProcess(FILE *in) {
    const unsigned int MAX_DATA_ITEMS = 10000;
    unsigned int size;
    unsigned long tag;
    int *data = malloc(MAX_DATA_ITEMS * sizeof(int));
    fread(&size, 4, 1, in);
    unsigned int data_count = size / sizeof(int);
    if (data_count > MAX_DATA_ITEMS) {
        fprintf(stderr, "TOO BIG!\n");
        abort();
    } else {
        fread(&tag, 8, 1, in);
        fread(&data[0], size - 8, 1, in);
        DoSomethingWith(tag, data, data_count);
    }
}

(The C standard library fread(p, S, N, i) reads S*N bytes from the file i into the buffer pointed to by p.)

This function is intended to read data in the following binary format:

• a 4-byte unsigned integer size
• size bytes consisting of:
  • a 8-byte value called tag
  • as many 4-byte integers as will fit called data

But if the compiler performs arithmetic in the code above using 4-byte unsigned ints, then this code may attempt to overflow the heap-allocated buffer data. Give an example of a value for size the attacker could choose to trigger the overflow. Write your answer as a base-10 number.

Suppose a buffer vulnerable to overflow is stored in a struct like the following:

struct vulnerable_struct {
    char buffer[128];
    long *current;
};

void vulnerable(struct vulnerable_struct *s) {
    scanf("%s", s->buffer);  // <-- CAN OVERFLOW s->buffer 
    s->current = atol(s->buffer);
}

(atol converts a string to an long; if the string contains extra text after the integer (e.g. "102cf"), it returns the integer at the beginning.)

One way an attacker can exploit the buffer overflow is by overwritin the adjacent value of s->current. Which of the following values could be useful [not in original question, but should have been: to place in s->current] as part of turning this exploit into something that would trigger execution of code of the attacker's choice? Select all that apply.

In lecture we mentioned relocation read-only (RELRO), in which information filled in by the dynamic linker, like global offset tables and virtual function tables, is configured to be read-only immediately after the program loads. Which of the following would be prevented by RELRO? Select all that apply.

Suppose a prorgam supports multiple user interfaces. To implement this functionality, it chooses between several different sets of user interface functions based on a configuration parameter. Each user interface is represented by a struct containing pointers to relevant functions:

    struct ui_functions {
         /* this declares a field 'DisplayString' which is a pointer to
             function returning void and taking a const char * argument */
        void (*DisplayString)(const char *);
        void (*LocateFile)(const char*, const char *, int);
        ...
    };

A global variable points to the currently active set of functions:

    struct functions *current_ui_functions;

At program startup, the program allocates a new instance of this struct on the heap, initializes its function pointers based on a configuration file, and then sets current_ui_functions to point to that new instance of the struct.

After startup, the program would call particular functions using this global variable using code like:

    (current_ui_functions->DisplayString)(argument);

(which could also be written ((*current_ui_functions).DisplayString)(argument).)

Suppose that in order to prevent buffer overflow attacks from interfering with this, the program arranged for guard pages to be placed on either side of the pointer current_ui_functions. Which of the following operations would these guard pages be likely to prevent? Select all that apply.

Suppose we have discovered that a program contains the following gadgets at the following addresses:

• at address 0x100000: popq %rcx; popq %rax; popq %rdi; ret
• at address 0x100100: pushq %rax; push %rbx; cmp %rax, %rbx; ret
• at address 0x100200: movl (%rax), %eax; ret
• at address 0x100300: movl %edi, %esi; movl %eax, %edi; ret
• at address 0x100400: pushq %rdi; pushq %rsi; ret
• at address 0x100500: popq %rsi; ret

Suppose also that 0x300000 is the address of a writeable global variable.

Suppose we wanted to use these gadgets to call a function void foo(int x, int y) located at address 0x200000 as if it were called like:

foo(0x42, 0x43);

Which of the following are ROP chains (written with the overwritten return address first, followed by the other values that would be afterwards in memory) which would achieve this? Select all that apply.

In lecture, we discussed how an attacker might be able to take advantage of a bug that lets them write past the end of an object allocated on the heap with a particular kind of malloc/free implementation. In this attack, the malloc/free implementation kept a doubly linked list in free regions of the heap, and the attacker could overwrite the next and prev pointers for the following free region of the heap using their heap object overflow. As a result, the malloc/free implementation would write a value chosen by the attacker to a memory location chosen by the attacker.

Which of the following would prevent this attack strategy? Select all that apply.

Which of the following would prevent use-after-free vulnerabilities? Select all that apply.

In lecture, we mentioned that the C standard library functions strncpy and strncat can be nonintuitive to use as replacements for strcpy (string copy) and strcat (string concatenate) with bounds checking.

For example code, if an attacker could supply input of arbitrary length as the string attacker_input to code like:

char buffer[1024];
strncpy(buffer, attacker_input, sizeof buffer)
puts(buffer);

Then the attacker would likely be able to ___. Select all that apply.

In lecture, we discussed how a "fat pointer" representation is one strategy to add bounds checking to existing C code.

Suppose we have such a "fat pointer" represented as:

struct MyPtr {
    char *pointer;
    char *minimum;
    char *maximum;
}

as was shown in lecture. Code like

p[10] = 1;

would be converted to something like:

CHECK(p->pointer + 10 >= minimum && p-> pointer + 10 <= maximum);
p->pointer[10] = 1;

(where CHECK(x) is some function that will trigger a crash if x is false).

Similarly, we could convert code like:

memcpy(p, "ABCD", 4);

to code like:

CHECK(_________);
memcpy(p->pointer, "ABCD", 4);

where the blank in CHECK contains:

Which of the following are advantages of using symbolic execution to produce test cases over using random testing to produce test cases? Select all that apply.

Consider the following function:

int example(int a, int b, int c) {
    if (a > 10) {
        if (b > 10) {
            mystery1(a);
            if (c > 10) {
               mystery2(b);
            } else if (c == 10) {
               mystery3(b);
            }
        }
    }
    if (b == 20) {
        mystery4(a);
    }
}

If we were testing this function via coverage-guided fuzzing, than the fuzz tester would maintain a list of discovered distinct test cases, where a test case was considered distinct if it covered different path than any other test case.

Suppose this list initially contained:

a = 0, b = 0, c = 0
a = 0, b = 20, c = 0
a = 50, b = 50, c = 10

Which of the following variations would be considered new distint test cases? **Select all that apply.*

Consider the following C snippet:

int mystery;

void bar(char *p) {
    if (p[0] == 'A') {
        free(p)
    } else {
        strcat(p, "more example");
    }
}

void foo() {
    char *q = malloc(1024);
    strcpy(q, "example");
    bar(q);
    strcat(q, "another example");
    printf("q = %s\n", q);
    free(q);
}

Suppose a static analysis tool warns that a use-after-free may occur when foo() runs, but in the program in which this appears, that does not happen for any possible input. The analysis determines that after bar is Which of the following changes to the static analysis tool would avoid this false positive? Select all that apply.

In lecture we mentioned that constructing an information flow graph might be used to identify probable cases of SQL injection by seeing whether user input flows into a library call that accepts SQL code.

Consider the following (Python-like) pseudocode:

class_id = input()
order = input()
student_id = input()
q = 'SELECT * FROM registrations WHERE class = ' + class_id
if student_id != '':
    q += ' WHERE student_id = ?'
if order == 'id':
    q = q + ' ORDER BY registeration_id ASC'
elif order == 'applied_date' or order == 'enrolled_date':
    q = q + ' ORDER BY ' + order + ' ASC'
else:
    raise Exception("Invalid order")
sql_prepare_query(q)
...

Assuming we used the version of the analysis that did not consider control flow (e.g. a value being used as an if statement condition) to create an edge in the graph, this would detect the value passed to sql_prepare_query came from ___? **Select all that apply.**

Consider a dynamic taint tracking system, which tracks, for every value, whether or not it is tainted. Suppose a malware author wanted to defeat this system by creating false positives causing the value x appear to be dependent on y even though it is not really. Which of the following are likely to achieve this goal, if converted to unoptimized assembly (so expressions like y * 0 are not optimized into 0, etc.)? Select all that apply.

Which of the following do Rust's compiler-enforced and standard-library-enforced safety rules ensure (in the absence of code explicitly marked unsafe or bugs in the standard library code or compiler)? Select all that apply.

In lecture we mentioned the idea of privilege separation where an application is divided into multiple parts and some parts are sandboxed and run with fewer privilieges than the rest. Suppose we were adding privilege separation to a spreadsheet program. Which of the following components would be good candidates for functionality to implement in the less privilieged part of the spreadsheet program? Select all that apply.

Which of the following scenarios would using chroot (which changes the effective root directory for a process) and running a program within the chroot environment without system administrator/root permissions be effective for? Assume that chroot is not used in combination with mount namespaces, bind mounts, etc. Select all that apply.

When using containers, such as implemented by docker using Linux's chroot and namespaces features, we would expect containers to protect against a compromised web server running in the container ____. Select all that apply.

Which of the following techniques for confining applications are likely to have the side effect of changing where the application's files are stored? Select all that apply.

According to the principles we discussed for permissions prompts in lecture, it would be best to ____.