failnix/injections/09-15_10-33-10_test-empty_c_fail/known_outcome_asm.md

Program

#include "../lib.h"

extern "C" EXPORT("wasm_module") int wasm_module(void) {
  int x = 0;

  fail_start_trace();
  fail_stop_trace();

  if (x == 0) {
    PRINT("result correct.\n");
    fail_marker_positive();
    return 0;
  } else {
    PRINT("result incorrect.\n");
    fail_marker_negative();
    return 1;
  }
}

Program Disassembly

0010001a <fail_start_trace>:

#ifdef TARGET_LINUX
#include <stdio.h>
#endif

void fail_start_trace(void) {}
  10001a:   55                      push   ebp
  10001b:   89 e5                   mov    ebp,esp
  10001d:   90                      nop
  10001e:   5d                      pop    ebp
  10001f:   c3                      ret

0010003e <os_main>:

int wasm_module(void);

MAIN {
  10003e:   55                      push   ebp
  10003f:   89 e5                   mov    ebp,esp
  100041:   83 ec 18                sub    esp,0x18
  int retval = wasm_module();
  100044:   e8 94 00 00 00          call   1000dd <wasm_module>
  100049:   89 45 f4                mov    DWORD PTR [ebp-0xc],eax
  PRINT_SUCCESS("wasm_module returned %d.\n", retval);
  RET(retval);
  10004c:   90                      nop
}
  10004d:   c9                      leave
  10004e:   c3                      ret

001000dd <wasm_module>:
#include "../lib.h"

extern "C" EXPORT("wasm_module") int wasm_module(void) {
  1000dd:   55                      push   ebp
  1000de:   89 e5                   mov    ebp,esp
  1000e0:   83 ec 18                sub    esp,0x18
  int x = 0;
  1000e3:   c7 45 f4 00 00 00 00    mov    DWORD PTR [ebp-0xc],0x0

  fail_start_trace();
  1000ea:   e8 2b ff ff ff          call   10001a <fail_start_trace>
  fail_stop_trace();
  1000ef:   e8 2c ff ff ff          call   100020 <fail_stop_trace>

  if (x == 0) {
  1000f4:   83 7d f4 00             cmp    DWORD PTR [ebp-0xc],0x0
  1000f8:   75 0c                   jne    100106 <wasm_module+0x29>
    PRINT("result correct.\n");
    fail_marker_positive();
  1000fa:   e8 27 ff ff ff          call   100026 <fail_marker_positive>
    return 0;
  1000ff:   b8 00 00 00 00          mov    eax,0x0
  100104:   eb 0a                   jmp    100110 <wasm_module+0x33>
  } else {
    PRINT("result incorrect.\n");
    fail_marker_negative();
  100106:   e8 21 ff ff ff          call   10002c <fail_marker_negative>
    return 1;
  10010b:   b8 01 00 00 00          mov    eax,0x1
  }
}

Query

SELECT
    v.benchmark,
    p.known_outcome,
    oi.disassemble AS inject_disasm,
    p.injection_instr_absolute AS inject_addr,
    p.injection_instr AS inject_instr,
    o1.disassemble AS instr1_disasm,
    t.instr1_absolute AS instr1_addr,
    t.instr1 AS instr1,
    o2.disassemble AS instr2_disasm,
    t.instr2_absolute AS instr2_addr,
    t.instr2 AS instr2
FROM
    fsppilot p
    JOIN variant v ON v.id = p.variant_id
    LEFT JOIN trace t ON t.variant_id = p.variant_id
    AND t.instr2 = p.instr2
    AND t.data_physical_address = p.data_physical_address
    LEFT JOIN objdump oi ON oi.variant_id = p.variant_id
    AND oi.instr_address = p.injection_instr_absolute
    LEFT JOIN objdump o1 ON o1.variant_id = p.variant_id
    AND o1.instr_address = t.instr1_absolute
    LEFT JOIN objdump o2 ON o2.variant_id = p.variant_id
    AND o2.instr_address = t.instr2_absolute
WHERE
    p.known_outcome = 1
ORDER BY
    v.benchmark,
    p.variant_id,
    p.id;

Result

benchmark	known_outcome	inject_disasm	inject_addr	inject_instr	instr1_disasm	instr1_addr	instr1	instr2_disasm	instr2_addr	instr2
mem	1	push %ebp	10001A	0			0	push %ebp	10001A	0
regs	1	mov %esp,%ebp	10001B	1	push %ebp	10001A	1	mov %esp,%ebp	10001B	1