Meditation, The Art of Exploitation

Thinking? At last I have discovered it--thought; this alone is inseparable from me. I am, I exist--that is certain. But for how long? For as long as I am thinking. For it could be, that were I totally to cease from thinking, I should totally cease to exist....I am, then, in the strict sense only a thing that thinks.

Monday, July 24, 2006

The mythical 'bss' segment

BSS stands for 'Block Started by Symbols'. This is a segment reserved for uninitialized global variables on most unix/linux platforms. Consider the following example:


int init_d = 10; // .data
int noinit_d; // .bss

int main(){
printf(".data %p .bss %p\n", &init_d, &noinit_d);

Compile with -g -O0, run it will print the following lines:
.data 0x8049598 .bss 0x80495a0

Run 'objdump -s a.out':
Contents of section .rodata:
8048478 03000000 01000200 2e646174 61202570 %p
8048488 202e6273 73202570 0a00 .bss %p..
Contents of section .data:
804958c 00000000 00000000 a4940408 0a000000 ................

080494a4 points to the format string, 0a is the value of the initialized variable.

Run 'objdump -x a.out':
Idx Name Size VMA LMA File off Algn
21 .data 00000010 0804958c 0804958c 0000058c 2**2
22 .bss 00000008 0804959c 0804959c 0000059c 2**2
.bss segment starts from 0804959c and takes 8 bytes. The 2nd variable at 80495a0 is noinit_d in our source code.