Any solution to this puzzle !

[Nitin]

Hi All,

Consider the following code snippet:

------------------------------------------

#include <stdio.h>

void change()
{
/* write something here so that the printf in main prints the value of
'i' as 10 */
}

int main(void)
{
int i=5;
change();
printf("%d\n",i);
return 0;
}
------------------------------------------

apart from the trivial pre-processor trick like this:

#define printf(a,i) printf(a,2*i)

is there any way to achieve it ?

Thanks.

[Emmanuel Delahaye]

Nitin wrote on 16/07/05 :

#include <stdio.h>

void change()
{
/* write something here so that the printf in main prints the value of
'i' as 10 */
}

int main(void)
{
int i=5;
change();
printf("%d\n",i);
return 0;
}
is there any way to achieve it ?

Not to my knowledge. You need a parameter (int *) and to pass the
address of i (&i).

--
Emmanuel
The C-FAQ: http://www.eskimo.com/~scs/C-faq/faq.html
The C-library: http://www.dinkumware.com/refxc.html

"C is a sharp tool"

[Malcolm]

"Nitin" <mc*********@gmail.com> wrote

#include <stdio.h>

void change()
{
/* write something here so that the printf in main prints the value of
'i' as 10 */
}

int main(void)
{
int i=5;
change();
printf("%d\n",i);
return 0;
}
------------------------------------------

apart from the trivial pre-processor trick like this:

#define printf(a,i) printf(a,2*i)

is there any way to achieve it ?

A subroutine doesn't have any access to the caller's local variables.

However you can give it such access by passing them as pointers.

void change2(int *iptr)
{
/* do anything you wnat with the value you are passed */
printf("d", *iptr);
*iptr = 2;
}

[Keith Thompson]

"Nitin" <mc*********@gmail.com> writes:
[...]

#include <stdio.h>

void change()
{
/* write something here so that the printf in main prints the value of
'i' as 10 */
}

int main(void)
{
int i=5;
change();
printf("%d\n",i);
return 0;
}
------------------------------------------

apart from the trivial pre-processor trick like this:

#define printf(a,i) printf(a,2*i)

is there any way to achieve it ?

Fortunately, no.

--
Keith Thompson (The_Other_Keith) ks***@mib.org <http://www.ghoti.net/~kst>
San Diego Supercomputer Center <*> <http://users.sdsc.edu/~kst>
We must do something. This is something. Therefore, we must do this.

[Tim Woodall]

On 16 Jul 2005 14:12:39 -0700,
Nitin <mc*********@gmail.com> wrote:

Hi All,

Consider the following code snippet:

------------------------------------------

#include <stdio.h>

void change()
{
/* write something here so that the printf in main prints the value of
'i' as 10 */
}

int main(void)
{
int i=5;
change();
printf("%d\n",i);
return 0;
}
------------------------------------------

apart from the trivial pre-processor trick like this:

#define printf(a,i) printf(a,2*i)

is there any way to achieve it ?

No.

=====================================

but ...

tim@feynman:~/c$ gcc -Wall -ansi -pedantic -o x x.c
/tmp/ccca0IUM.o(.text+0x20): In function `change':
: warning: the `gets' function is dangerous and should not be used.

tim@feynman:~/c$ ./x
Please enter your password
11111111
Password OK
5
^ This is your i

tim@feynman:~/c$ ./x
Please enter your password
12345678
FAILED
^^^^^^ This is what supposed to happen if you give the wrong password.

tim@feynman:~/c$ ./x
Please enter your password
6666666666666666666666666666D
Password OK
10
^^ This is your i.

This is a very simple stack smashing attack. _Anything_ can happen, what
happens in practice is that an attacker crafts their attack so that the
"anything" becomes what the attacker wants.
===================== bad code follows =====================
The third example given above will probably _NOT_ work the same on your
system if you compile this code. That's what invoking undefined
behaviour means. (I have carefully "crafted" this code to make the
attack easy with my compiler on my system. I suspect that the "attack" is
possible on most systems but you may end up having to do a full stack
smash attack (see Smashing the Stack for Fun and Profit) rather than the
trivial special case I've got here.)

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* PASSWORDS are 8 characters plus null */
#define PASS_SZ 9

#define PASSWORD_HASH "66666666"

void change()
{
/* write something here so that the printf in main prints the value of
* 'i' as 10 */

int i = 0;
char buffer[PASS_SZ];

/*
printf("%p\n", (void*) buffer);
printf("%p\n", (void*) &i);
*/

printf("Please enter your password\n");
gets(buffer);

/*
printf("%d\n", i);
printf("%p\n", (void*) (buffer+i));
*/

/* Now "hash" the password */
do
buffer[i++] += 5;
while(i<PASS_SZ);

if(!memcmp(buffer, PASSWORD_HASH, strlen(PASSWORD_HASH)))
printf("Password OK\n");
else
{
printf("FAILED\n");
exit(EXIT_FAILURE);
}
}

int main(void)
{
int i=5;
/*
printf("%p\n", (void*) &i);
*/
change();
printf("%d\n",i);
return 0;
}
--
God said, "div D = rho, div B = 0, curl E = - @B/@t, curl H = J + @D/@t,"
and there was light.

http://tjw.hn.org/ http://www.locofungus.btinternet.co.uk/

[Alexei A. Frounze]

"Malcolm" <re*******@btinternet.com> wrote in message
news:db**********@nwrdmz02.dmz.ncs.ea.ibs-infra.bt.com...

"Nitin" <mc*********@gmail.com> wrote

#include <stdio.h>

void change()
{
/* write something here so that the printf in main prints the value of
'i' as 10 */
}

int main(void)
{
int i=5;
change();
printf("%d\n",i);
return 0;
}
------------------------------------------

apart from the trivial pre-processor trick like this:

#define printf(a,i) printf(a,2*i)

is there any way to achieve it ?

A subroutine doesn't have any access to the caller's local variables.

However you can give it such access by passing them as pointers.

void change2(int *iptr)
{
/* do anything you wnat with the value you are passed */
printf("d", *iptr);
*iptr = 2;
}

Continuing the perversity, we can do something like this:

int *p;
void change()
{
/* write something here so that the printf in main prints the value of
'i' as 10 */
*p = 10;
}

int main(void)
{
int i=5;
p = &i;
change();
printf("%d\n",i);
return 0;
}

Alex

[CBFalconer]

Tim Woodall wrote:

.... snip ...
printf("Please enter your password\n");
gets(buffer);

You just got laughed out of any society based on the C language.
Never, ever, use gets. For anything.

--
"If you want to post a followup via groups.google.com, don't use
the broken "Reply" link at the bottom of the article. Click on
"show options" at the top of the article, then click on the
"Reply" at the bottom of the article headers." - Keith Thompson

[Netocrat]

On Sat, 16 Jul 2005 23:54:18 +0000, CBFalconer wrote:

Tim Woodall wrote:

... snip ...

printf("Please enter your password\n");
gets(buffer);

You just got laughed out of any society based on the C language.
Never, ever, use gets. For anything.

But don't you think that the point of his post was to demonstrate why gets
is so dangerous?

i.e. he expressly showed us the compiler warning and headed his source:
"bad code follows".

[Robert Gamble]

CBFalconer wrote:

Tim Woodall wrote:

... snip ...

printf("Please enter your password\n");
gets(buffer);

You just got laughed out of any society based on the C language.
Never, ever, use gets. For anything.

Let's take a look at some of what you conveniently snipped:

tim@feynman:~/c$ gcc -Wall -ansi -pedantic -o x x.c
/tmp/ccca0IUM.o(.text+0x20): In function `change':
: warning: the `gets' function is dangerous and should not be used.
and
===================== bad code follows =====================
The third example given above will probably _NOT_ work the same on your
system if you compile this code. That's what invoking undefined
behaviour means. (I have carefully "crafted" this code to make the
attack easy with my compiler on my system. I suspect that the "attack" is
possible on most systems but you may end up having to do a full stack
smash attack (see Smashing the Stack for Fun and Profit) rather than the
trivial special case I've got here.)

From the rest of the post it is obvious that Tim was using the weakness

of the gets() function to demonstrate the exact reason it shouldn't be
used by showing how such code could be exploited.

I'm assuming you just neglected to read the post before you replied (as
opposed to being dense or a troll).

Robert Gamble

[CBFalconer]

Robert Gamble wrote:

CBFalconer wrote:

Tim Woodall wrote:

... snip ...

printf("Please enter your password\n");
gets(buffer);

You just got laughed out of any society based on the C language.
Never, ever, use gets. For anything.

Let's take a look at some of what you conveniently snipped:

: warning: the `gets' function is dangerous and should not be used.
and
===================== bad code follows =====================

.... snip ...

From the rest of the post it is obvious that Tim was using the
weakness of the gets() function to demonstrate the exact reason
it shouldn't be used by showing how such code could be exploited.

I'm assuming you just neglected to read the post before you
replied (as opposed to being dense or a troll).

True. I saw a gets in passing and reacted like a Pavlovian dog.

--
"If you want to post a followup via groups.google.com, don't use
the broken "Reply" link at the bottom of the article. Click on
"show options" at the top of the article, then click on the
"Reply" at the bottom of the article headers." - Keith Thompson

[Keith Thompson]

CBFalconer <cb********@yahoo.com> writes:

Robert Gamble wrote:

[...]

I'm assuming you just neglected to read the post before you
replied (as opposed to being dense or a troll).

True. I saw a gets in passing and reacted like a Pavlovian dog.

They usually respond better to putchar('\a').

--
Keith Thompson (The_Other_Keith) ks***@mib.org <http://www.ghoti.net/~kst>
San Diego Supercomputer Center <*> <http://users.sdsc.edu/~kst>
We must do something. This is something. Therefore, we must do this.

[Chris Croughton]

On Sun, 17 Jul 2005 05:18:05 GMT, Keith Thompson
<ks***@mib.org> wrote:

CBFalconer <cb********@yahoo.com> writes:

Robert Gamble wrote:

[...]

I'm assuming you just neglected to read the post before you
replied (as opposed to being dense or a troll).

True. I saw a gets in passing and reacted like a Pavlovian dog.

They usually respond better to putchar('\a').

I'd post that to ahbou if (a) I could remember how and (b) I thought
that anyone outside the C community would get the joke...

Chris C

[cs]

On 16 Jul 2005 14:12:39 -0700, "Nitin" <mc*********@gmail.com> wrote:

Hi All,

Consider the following code snippet:

------------------------------------------

#include <stdio.h>

void change()
{
/* write something here so that the printf in main prints the value of
'i' as 10 */
} int main(void)
{
int i=5;
change();
printf("%d\n",i);
return 0;
}
------------------------------------------

apart from the trivial pre-processor trick like this:

#define printf(a,i) printf(a,2*i)

is there any way to achieve it ?

Thanks.

i think in "standard c" is not possible (nor desirable).
this seems ok for my cpu+compiler+os

#include <stdio.h>

void change()
{
/* write something here so that the printf in main prints the value of
'i' as 10 */
asm{ mov ebx, 10
pop eax
push ebx
}
}

/* compiler says that i==ebx */
int main(void)
{
int i=5;
change();
printf("%d\n",i);
return 0;
}
-------------------
C:\i>ex
10

[noblesantosh]

Hi nitin,
Check it out, it works absolutely perfect.

#include <stdio.h>

void change(void)
{
/* write something here so that the printf in main prints the
value of
* 'i' as 10 */
asm(" popl %ebp ");
asm(" movl $10, -4(%ebp) ");
asm(" pushl %ebp ");

}

int main(void)
{
int i = 5;
change();
printf("%d\n", i);
return 0;
}

--santosh
Nitin wrote:

Hi All,

Consider the following code snippet:

------------------------------------------

#include <stdio.h>

void change()
{
/* write something here so that the printf in main prints the value of
'i' as 10 */
}

int main(void)
{
int i=5;
change();
printf("%d\n",i);
return 0;
}
------------------------------------------

apart from the trivial pre-processor trick like this:

#define printf(a,i) printf(a,2*i)

is there any way to achieve it ?

Thanks.

[Richard Heathfield]

no**********@yahoo.com wrote:

Hi nitin,
Check it out, it works absolutely perfect.

gcc -W -Wall -ansi -pedantic -O2 -g -pg -c -o foo.o foo.c
foo.c: In function `change':
foo.c:8: warning: implicit declaration of function `asm'
gcc -W -Wall -ansi -pedantic -O2 -g -pg -o foo foo.o
foo.o: In function `change':
foo.c:8: undefined reference to `asm'
foo.c:9: undefined reference to `asm'
foo.c:10: undefined reference to `asm'
collect2: ld returned 1 exit status
make: *** [foo] Error 1

--
Richard Heathfield
"Usenet is a strange place" - dmr 29/7/1999
http://www.cpax.org.uk
mail: rjh at above domain

[noblesantosh]

it works, compile it as follows,

gcc foo.c -o foo

Later try with other options and let me know what happens.
--santosh

[Richard Heathfield]

no**********@yahoo.com wrote:

it works,
No, it doesn't.
compile it as follows,

gcc foo.c -o foo

That command line does not meet my quality control criteria.
--
Richard Heathfield
"Usenet is a strange place" - dmr 29/7/1999
http://www.cpax.org.uk
mail: rjh at above domain

[noblesantosh]

the asm keyword is not a part of the ANSI C standard. you cann't use
-ansi -pedantic with this code.

[Richard Heathfield]

no**********@yahoo.com wrote:

the asm keyword is not a part of the ANSI C standard.
Precisely.
you cann't use
-ansi -pedantic with this code.

You have that exactly the wrong way around.

--
Richard Heathfield
"Usenet is a strange place" - dmr 29/7/1999
http://www.cpax.org.uk
mail: rjh at above domain

[noblesantosh]

hello richard,

Could you tell me how to write inline assembly in ansi compatible code,
so that I can modify that code to suit your quality control criteria.
--santosh

[Anand]

no**********@yahoo.com wrote:

Hi nitin,
Check it out, it works absolutely perfect.

#include <stdio.h>

void change(void)
{
/* write something here so that the printf in main prints the
value of
* 'i' as 10 */
asm(" popl %ebp ");
asm(" movl $10, -4(%ebp) ");
asm(" pushl %ebp ");

}

int main(void)
{
int i = 5;
change();
printf("%d\n", i);
return 0;
}

--santosh
Nitin wrote:

Hi All,

Consider the following code snippet:

------------------------------------------

#include <stdio.h>

void change()
{
/* write something here so that the printf in main prints the value of
'i' as 10 */
}

int main(void)
{
int i=5;
change();
printf("%d\n",i);
return 0;
}
------------------------------------------

apart from the trivial pre-processor trick like this:

#define printf(a,i) printf(a,2*i)

is there any way to achieve it ?

Thanks.

If the basic idea is to get the address of i from the stack..
can't I use something like this?
#include <stdio.h>
static long stackFrameSize=0;
void foo()
{
int x;
stackFrameSize = stackFrameSize - (long)&x;
}
void change()
{
int x;
stackFrameSize = (long )&x;
foo();
int *i= (int*)((unsigned long )&x + stackFrameSize -sizeof(int));
(*i)+=5;
}

int main(void)
{
int i=5;
change();
printf("%d\n",i);
return 0;
}

--Anand

[noblesantosh]

Anand,
you cann't use i in change() function, i is local to main()

--santosh

[CBFalconer]

no**********@yahoo.com wrote:

the asm keyword is not a part of the ANSI C standard. you cann't
use -ansi -pedantic with this code.

With what code? Include adequate context. If in doubt, scan the
group for sigs involving google and its broken interface.

Gcc, without -ansi - pedantic, is NOT a C compiler. It compiles
something the GNU people call GNU C, which does not conform to the
C standard.

--
Chuck F (cb********@yahoo.com) (cb********@worldnet.att.net)
Available for consulting/temporary embedded and systems.
<http://cbfalconer.home.att.net> USE worldnet address!

[Flash Gordon]

no**********@yahoo.com wrote:

it works, compile it as follows,

gcc foo.c -o foo

Later try with other options and let me know what happens.

Please provide context so that people can see what you are replying to.
If you read this group you will find Kieth and CBFalconer regularly
providing instructions.

In any case, not it does not work:

bash-2.04$ cat t.c
#include <stdio.h>

void change(void)
{
/* write something here so that the printf in main prints the
value of
* 'i' as 10 */
asm(" popl %ebp ");
asm(" movl $10, -4(%ebp) ");
asm(" pushl %ebp ");

}

int main(void)
{
int i = 5;
change();
printf("%d\n", i);
return 0;
}
bash-2.04$ gcc t.c -o t
Assembler:
/tmp//ccdwnHom.s: line 21: 1252-142 Syntax error.
/tmp//ccdwnHom.s: line 22: 1252-016 The specified opcode or pseudo-op is
not valid.
Use supported instructions or pseudo-ops only.
/tmp//ccdwnHom.s: line 22: 1252-142 Syntax error.
/tmp//ccdwnHom.s: line 23: 1252-142 Syntax error.
bash-2.04$

The point is that asm (as used in your program) is an extension and not
part fo the C language, and it is not portable even amongst the systems
that have it.
--
Flash Gordon
Living in interesting times.
Although my email address says spam, it is real and I read it.

[Richard Heathfield]

no**********@yahoo.com wrote:

hello richard,

Could you tell me how to write inline assembly in ansi compatible code,

It's a contradiction in terms. One of the most important reasons for writing
ANSI (or ISO) conforming code is so that you can move the code from
platform to platform without having to spend years rewriting it for the new
platform.

Neither assembly language, nor mechanisms for embedding it within C code,
are standard across disparate platforms or compilers.

--
Richard Heathfield
"Usenet is a strange place" - dmr 29/7/1999
http://www.cpax.org.uk
mail: rjh at above domain

[Anand]

no**********@yahoo.com wrote:

Anand,
you cann't use i in change() function, i is local to main()

--santosh

Probably you missed it.. the i in change() is a different i i.e. int *i
not the same one as in main()
see below
----------to make it different----
#include <stdio.h>
static long stackFrameSize=0;
void foo()
{
int x;
stackFrameSize = stackFrameSize - (long)&x;
}
void change()
{
int x;
stackFrameSize = (long )&x;
foo();
int *ptri= (int*)((unsigned long )&x + stackFrameSize -sizeof(int));
(*ptri)+=5;
}

int main(void)
{
int i=5;
change();
printf("%d\n",i);
return 0;
}

[noblesantosh]

anand (26),

Ok, but is it doing, what it needs to do. It has to chage i.

---santosh

[Chris Croughton]

On 18 Jul 2005 00:11:07 -0700, no**********@yahoo.com
<no**********@yahoo.com> wrote:

it works, compile it as follows,
What works? Quote the relevant parts of the message to which you are
replying.
gcc foo.c -o foo
command not found: gcc
Later try with other options and let me know what happens.

Undeclared function 'asm', whatever options I use to the C compiler
(which is a C compiler, not a C-like compiler). Not that it would help
even if the 'asm' function were to use its argument as assembler,
there's no such instructions as ppol, movl and pushl on that
processor...

Chris C

[Anand]

no**********@yahoo.com wrote:

anand (26),

Ok, but is it doing, what it needs to do. It has to chage i.

---santosh

Why do you think it doesn't do..
Assuming a system where stack grows up and the stack context size is
same for two functions with similar signature
so i am getting hold of the address of i
and modifying it..

[Walter Roberson]

In article <mj*************@news.oracle.com>,
Anand <An***@no-replies.com> wrote:

Why do you think it doesn't do..
Assuming a system where stack grows up and the stack context size is
same for two functions with similar signature
so i am getting hold of the address of i
and modifying it..

Neither of those two assumptions are portable. The machine
I am using right now grows its stack downwards, and whether the
stack context size is the same or different for two functions with
similar signatures depends upon the optimization level chosen
and upon the optimizer's determination of opportunities
(which might include intra-procedural analysis...)

--
"I want to make sure [a user] can't get through ... an online
experience without hitting a Microsoft ad"
-- Steve Ballmer [Microsoft Chief Executive]

[Bernhard Holzmayer]

Nitin wrote:

Hi All,

Consider the following code snippet:

------------------------------------------

#include <stdio.h>

void change()
{
/* write something here so that the printf in main prints the value of
'i' as 10 */
}

int main(void)
{
int i=5;
change();
printf("%d\n",i);
return 0;
}
------------------------------------------

apart from the trivial pre-processor trick like this:

#define printf(a,i) printf(a,2*i)

is there any way to achieve it ?

Thanks.

Hi Nitin,

here's a standard conformal solution.
It uses the pre-processor, though.
Nevertheless it's very bad coding style.
Never do this in production-level coding environments!!!!
#include <stdio.h>

#define change() change(int * pi)

void change()
{
*pi +=5;
}

#undef change
#define change() change_(&i)

int main(void)
{
int i=5;
change();
printf("%d\n",i);
return 0;
}

Your compiler has an option, which makes the pre-process replacements
visible. If you use GNU, it's "gcc -E source.c"
This will result in code like this:
....
void change(int * pi)
{
*pi +=5;
}

int main(void)
{
int i=5;
change(&i);
printf("%d\n",i);
return 0;
}

So, the preprocessor does, what you should have coded in the first place.
This might be a valuable help, if you had to work with legal code where you
don't want to modify a line, or you simply may not.
And, it could be helpful under debugging circumstances(instrumentation).

Bernhard

[Chris Croughton]

On 18 Jul 2005 02:32:31 -0700, no**********@yahoo.com
<no**********@yahoo.com> wrote:

Could you tell me how to write inline assembly in ansi compatible code,
so that I can modify that code to suit your quality control criteria.

You can't. In standard C there is no way to use assembler. Various
compilers may provide a way, or provide the ability to link to code
written in assembler, but that is outside the standards and is
inherrently non-portable (since each compiler may have different syntax
for it if they support it at all).

Chris C

[Anand]

Walter Roberson wrote:

In article <mj*************@news.oracle.com>,
Anand <An***@no-replies.com> wrote:

Why do you think it doesn't do..
Assuming a system where stack grows up and the stack context size is
same for two functions with similar signature
so i am getting hold of the address of i
and modifying it..

Neither of those two assumptions are portable. The machine
I am using right now grows its stack downwards, and whether the
stack context size is the same or different for two functions with
similar signatures depends upon the optimization level chosen
and upon the optimizer's determination of opportunities
(which might include intra-procedural analysis...)

Agreed..

atleast the stack growing downwards could be handled..
just by checking the sign of the stackFrameSize (-ve ==> grow down)

int *ptri= (int*)((unsigned long )&x + stackFrameSize);
if (stackFrameSize < 0)
ptri = (int *)((unsigned long) ptri + sizeof(int));
else
ptri = (int *)((unsigned long) ptri - sizeof(int));

[Anand]

Walter Roberson wrote:

In article <mj*************@news.oracle.com>,
Anand <An***@no-replies.com> wrote:

Why do you think it doesn't do..
Assuming a system where stack grows up and the stack context size is
same for two functions with similar signature
so i am getting hold of the address of i
and modifying it..

Neither of those two assumptions are portable. The machine
I am using right now grows its stack downwards, and whether the
stack context size is the same or different for two functions with
similar signatures depends upon the optimization level chosen
and upon the optimizer's determination of opportunities
(which might include intra-procedural analysis...)

Agreed..

atleast the stack growing downwards could be handled..
just by checking the sign of the stackFrameSize (-ve ==> grow down)

int *ptri= (int*)((unsigned long )&x + stackFrameSize);
if (stackFrameSize < 0)
ptri = (int *)((unsigned long) ptri + sizeof(int));
else
ptri = (int *)((unsigned long) ptri - sizeof(int));