Can I write to NULL (0x0000000000) without seg faulting?
ฝัง
- เผยแพร่เมื่อ 21 ก.ย. 2024
- Patreon ➤ / jacobsorber
Courses ➤ jacobsorber.th...
Website ➤ www.jacobsorbe...
---
Can I write to NULL (0x0000000000) without seg faulting? // Inspired by a student question. I think I know the answer, but I've never tried. So, let's see if I can convince the operating system (kernel) to map page #0 into my address space and allow me to access it like I would any other page.
Related Videos:
mmap-basics: • How processes get more...
***
Welcome! I post videos that help you learn to program and become a more confident software developer. I cover beginner-to-advanced systems topics ranging from network programming, threads, processes, operating systems, embedded systems and others. My goal is to help you get under-the-hood and better understand how computers work and how you can use them to become stronger students and more capable professional developers.
About me: I'm a computer scientist, electrical engineer, researcher, and teacher. I specialize in embedded systems, mobile computing, sensor networks, and the Internet of Things. I teach systems and networking courses at Clemson University, where I also lead the PERSIST research lab.
More about me and what I do:
www.jacobsorbe...
people.cs.clem...
persist.cs.clem...
To Support the Channel:
+ like, subscribe, spread the word
+ contribute via Patreon --- [ / jacobsorber ]
Source code is also available to Patreon supporters. --- [jsorber-youtub...]
![เขามัทรี - เอ็กซ์ ศุภกฤต - จอนนี่มิวสิค [ Official MV ]](http://i.ytimg.com/vi/AS9ufKuQIVs/mqdefault.jpg)
Fun fact: on AVR microcontrollers, NULL is address zero, and is mapped to the internal CPU register r0. You should be able to write to NULL without crashing if, right after doing that, you tell the compiler that you just clobbered r0, which you can do using the “clobber list” of an inline assembly directive.
Thanks Edgar, I can use that tip.
Whenever you leave the realm of standard C or C++, test your environmen as much as possible: compiler, compiler version, processor architecture, whatever. If you get unexpected values:
#error "system dependent code used outside expected environment. Please re-qualify. See document 1234.56.78"
Yup, though it would be a little bit more involved. You need to write and install some kind of rootkit.
On the ATTINY3217 NULL is a valid address in the memory space, it is a general purpose register with IN/OUT and direct bit manipulation functionality (look it up in the datasheet)
NULL, in particular, for mmap as the address argument without specifying MAP_FIXED tells mmap to choose the location for the user.
Addresses other than NULL are also just hints without MAP_FIXED.
Even with MAP_FIXED, Linux will not allow all users to map memory to NULL, but it does allow it for some, like the root user.
So if you call mmap with MAP_FIXED and NULL and run it as root, it actually does work.
Something slightly different: when writing an OS and/or working with physical memory directly, there are times when one has to work with memory at around NULL.
Could you explain why?
@@KangJangkrik under Linux mmap_min_addr defines the lowest address an unprivileged user can map memory to.
This limitation primarily exists to make NULL pointer dereference bugs in the kernel harder to exploit.
mmap_min_addr is ignored if the process runs under root since root already has full control over the kernel.
mmap_min_addr can also be changed to 0 to allow unprivileged users to map memory to 0.
in /proc/pid/maps 00000000-00001000 rw-p 00000000 00:00 0
I made a wip OS with grub, and writing to NULL caused the entire computer to reboot lmao
@@cerulity32k im working on the millionth (it feels like) iteration of my os and i have everything mostly working and im pretty much implementing the required syscalls to port newlib to it
I think you can write to null on Windows 9x (at least without any patches). Why:
Because the low 64k is mapped for DOS compatibility
But what is more interesting:
It is actually mapped to physical memory (not VM)
As a consequence:
Writing to null overwrites the pointer to the interrupt table!
And I have tried it. It broke the system.
Good point. But then he said “modern operating system” which restricts the options quite a lot.
@@Martin.Krischik Also depends on what is considered "modern". If you include anything that requires an MMU, Windows 9x is to be considered modern. However, it is not an SMP OS.
@@milasudril There are newer embedded OS which don't require an MMUs.
For a good answer you need a few more parameter:
1) Consumer OS vs embedded OS
2) MMU vs no MMU.
3) CPU with super user mode vs no super user mode.
If you are in super user mode or the CPU has no super user mode than you can just reprogram the MMU.
It is not the pointer to the interrupt table that you would be overwriting, it would be a pointer IN the interrupt table that you would be overwriting, specifically the pointer to the real mode divide by zero handler.
On x86 Win9X uses VM8086 mode for many operations such as disk operations. It would make sense then that it would identity map this region. Since the IVT is stored at 0x0000:0, then overwriting any info here would break your BIOS calls (which again, the OS is using regularly, so it would break immediately)
So others have mentioned how you can use MAP_FIXED to let mmap actually map to page 0. On linux at least you still require root access to run the program. Its possible to configure the system to allow normal users to mmap to page 0 by also setting the vm.mmap_min_addr to sysctl variable to 0.
That is,
sysctl vm.mmap_min_addr=0
This might be possible om some microcontrollers. The standard does not require NULL to necessarily be zero.
This is what i was thinking, microcontrollers don't have an OS or even an RTOS usually, but they might simply not work properly if you screw around with the low address values. IIRC, most low addresses still have specific functions on microcontrollers so you shouldn't screw with them, but they'll probably at least let you do it
I think on cortex m0 to m4, address 0 is the startup address, where you init BSS and set stack and frame pointers and jump to main.
it's written to flash so you are going to hardfault on that. You can use flash erase+ flash write operations to write on it. thats what bootloaders do.
@@xBoBox333 in ARM address 0 is flash .. address somthing 0x0040000 is Ram .. everything is yours but you have to respect how to setup .bss and data in memory, stack and how c works before you call main function.. and yeah how arm boots and expect address 0 to point to vector table of ISR routines.
So you might change something that is actually a constant or random global variable of your program..
The standard DOES require the null pointer to be 0.
section 6.3.2.3 of C99
Would definitely like to know why the linker script did that, could be a good video topic
Pls finally something about linker scripts!
According to the manpage for `mmap`, specifying `addr` as NULL should indeed work if you include the `MAP_FIXED` flag. (See in the `NOTES` section.)
Didn't work for my, though. Failed with: `mmap: Operation not permitted`.
By default, user processes are not allowed to map low memory addresses. Search for "debian wiki mmap_min_addr" for an explanation.
@@maxsilvester1327 Oh, interesting. Thanks for the explanation!
So close to 100K subs. You totally deserve it. I'm starting a new software business so have to watch the pennies. If it works I will definitely become a patron, your videos have been very helpful!
mmap return (void*)-1 and not NULL on error.
Imagine you get into an OS class and you walk into the room, prof says you dont have to buy a textbook, but that you do have to subscribe to his patreon for his office hours 😂
Ages ago the Intergraph CLIX (Clipper based) Unix boxes would, by default, map read-only memory memory to page 0. The memory would contain all zeros. So if you dereferenced a null pointer for reading, you would get zero. I suppose this was to be "helpful" and keep a program from potentially crashing? But it certainly hid a lot of logic errors. I recommended to our group that we link with the -z flag, which kept it from mapping memory to the zero page. But then it started blowing up in libraries we called. Eventually there was a push to get all applications and libraries to test with the -z flag. So we would do all our testing and development with -z then remove it (i.e. turn on zero page memory) for production releases.
In 80x86 real mode you can't handle division overflow interrupt without writting to NULL: interrupt table is located at the beginning of address space and int 0h vector is at 0000:0000.
Real mode disables memory protection and virtual addressing, so that's fine... you won't segfault.
If the memory is virtual anyway than null doesn't have to even correspond to any physical memory.
But you still have aligment so maybe you would have wasted one Byte per process if it did give you the first page 🤷♀
To sum up a lot of comments: the episode is based on a simplification. User land has protections to forbid the user from doing bad thing. So the C API actively prevent from doing bad things around the NULL address as a convenience for the user. In kernel land or if your platform map memory directly to the metal, everything can happen since the NULL address can map or not to physical memory (usually yes). And usually stuff exist in page 0, like interrupt tables, stack, or whatever make sense for the processor.
I was immediately going to jump into details of how is the actual standard written but actually the video might be interesting anyway - from technical stand point.
(*Basically the just of the argument is that 0 might actually not be 0 and for example in microsoft cl (Visual Studio) compiler when using based pointers that can be actually the case)
(*And no the NULL macro should always be 0 - the point is that the 0 null pointer constant may be represented by a different actual number (so 0 is just a token - when used in a context where pointer is expected - otherwise it's still a number 0))
I am very late with this, but it is possible on Linux if the kernel is compiled with CONFIG_DEFAULT_MMAP_MIN_ADDR=0
In "Computer Science from the bottom up" book - it mentions the kernel reserves itself some space right at the top in VM. Not sure if that includes the very lowest addresses? Obviously we get a seg fault. But I wonder if the kernel memory is special somehow? Can processes access it? Quote from the book: "An example of how the process is laid out in memory by the kernel is given above. Starting from the top, the kernel reserves itself some memory at the top of the process".
0x0000 is at the bottom of the memory map, not the top.
U can't write to address 0 in microcontroller as it is in the flash space, will cause hardfault. If it is in the RAM space, u could write to it.
Depends on the microcontroller, of course. They're all different. Not all have flash memory, and not all have the same memory layout. But, yeah, most will hardfault if you write to NULL. I've actually seen a lot of programmers use that as an easy way to reboot their MCU. Just write to NULL. Definitely requires good comments so people don't think you've lost your mind.
IIRC ion the x86 family, address 0 is used to boot up the system (I think it's a pointer to an address), so it resides in ROM. So no, you can't write to it, although, if the OS allows it, you might be able to read from it. That probably won't ever work as an unprivileged user.
That is only relevant when in real mode. If you boot in any modern OS that uses the MMU it doesn't apply
Thanks.
I *definitely* want to see an episode about linker scripts! To me, they are the part of the compilation process I understand *least*.
source files produce modules - modules can be linked directly into an binary/executable or they can be linked into libraries (which are just collections of modules) - a module importantly contains information about (a) public symbols that it exposes (b) external symbols that it references and (c) all the locations inside where direct addresses are relative to its eventual load address (which is minimal these days because x64 loves relative addressing.)
@@styleisaweapon Right, but for anything complicated enough I can’t just hand the compiler a collection of object files to link, I need a linker script, which I don’t understand. I know the basics of linking in general, just not anything complicated enough I can’t have gcc write the script automatically behind the scenes.
@@danielrhouck why cant you? its how the linker works - its how all linkers have always worked
@@styleisaweapon Because I have not yet learned how, partially because I haven’t found a good intro and partially because I’ve spent time learning other things? That’s why I said it’d be interesting to have a video about them; it’d be a good place to start.
I can sometimes *read* linker scripts if they aren’t too complicated, but I don’t know enough to even write a simple one yet.
@@danielrhouck so when you said that a particular thing cant be done ... you didnt mean that it cant be done...
the front end dev inside of me is crying
maybe because the "virtual address" to physical address mapping , so u actually can NEVER get the real physical address u required?
Hey, could you talk about parsing at some point? I'm trying to write a database management system, and I'm at a slight loss as to how to parse queries. Thanks.
Yes, please do explain lex() and yak() in one easy 15 minute video. I dare you! Love you videos Jacob.
😂 I'll see what I can do.
there's a book called Crafting Interpreters that you can read online for free; it has its own website and everything. it focuses on writing new programming/scripting languages, but the basic ideas it teaches about designing and parsing a "grammar" could be adapted to query and markup languages as well.
the book goes over scanning and parsing: breaking an input string into raw tokens (e.g. "plus symbol" or "right-hand parenthesis" or "word"), and then poring over those tokens to identify "grammatical" constructs (e.g. "addition" or "function call" or "identifier"). the basic idea is that the meaning of, say, a plus sign could vary by context, so tokens are the raw pieces without context, and the grammar stuff is what you get when you view these raw parts in context. it allows you to move the logic for "skip over comments" and the like away from the grammar, and keep concerns separate.
Not true. I write to a mmap region given to me by a video frame grabber device that returns NULL. Try mmap(NULL, 1024*768, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); where fd is from opening /dev/fb0 or whatever your frame buffer device might be registered as. I ran into this myself because I was mistakenly checking for null when i passed the pointer returned by mmap to another function....
i get that for practical purposes, "NULL" does point to _somewhere,_ but in a theoretical sense NULL isnt really supposed to be _anything,_ that's why its NULL. so, in this context, what does it even really _mean_ to write to NULL?
Wha if you gave an address from next page, but give a negative length?
I guess when u write bare metal hardware code (like for microcontroller) instead of an modern OS-API it is possible.
EASY WORKS THANKS
Jacob, is it possible do a program in C memory safe? Where segfault is impossible?
The real question is: what is stored at 0x0?
Comments to Jane and Max re my code segment: Here is one more way to divide the world into two arbitrary categories.
Programmers like Jane who are horrified that the code segment could even exist and move toward ever more protective and abstracted languages with a goal of provably correct code that is safe and sane for all. Let’s call them application programmers, bless their hearts. By preference this group would attach every kind and size of training wheels to a language they can find, probably not even daring to run attest “Hello World” program if it failed Lint.
And int the other group, more like Max and certainly more like me, who could not imagine wanting any language that wouldn’t give this kind of control. Let’s call then system programmers. Given correct constraints I would choose hardware with solder as my programming language, moving up to Assembly to build the drivers. After that it is all raw C and SOMEBODY has to be able to write to those parts of the operating system memory if you want to write an operating system.
Yep. Group 2, surrounded by group 1
You seem to be mistaking provably correct with provably safe - application programmers want provably safe and languages have evolved towards that over my lifetime - provably correct is deceptively simple but in practice its very hard to do outside of functional languages with heavy asserting.
What if we've done a classic overflow attack on computer's memory? I mean, sure, we would start again from the beginning of the memory, but what if we somehow overwrote the starting point address to NULL? :v
So is there a reason why (In this case XNU) doesn't allow you map the lower pages? I would assume that it reserves the lower pages for the kernel.
I would very much like a video about linker script.
So what happens to the memory at 0x0 is it just never used for anything which would mean that little bit of memory is always wasted?
There is (often) no memory there.
Modern operating systems use something called virtual memory. An operating system can map physical memory into this virtual address space that can then be accessed through (virtual) addresses. If something is not mapped (which is often the case for NULL), then any access to it will cause a fault because there is nothing there that can be accessed.
Please talk more about linker scripts.
int *ptr;
ptr = NULL;
*ptr = 0xDEADBEEF;
There, just wrote to NULL. The real question is
how do you trick up the OS, if there is one,
into NOT generating HW or SW fault.
Happy hacking!
A good compiler will issue a warning here. And a good programmer let the compiler treat warnings as errors.
So this program fragment will never see the hardware.
@@Hauketal your last statement removes the difference between warnings an errors.
If that was good practice, compiler guys would remove warnings at all and only use errors.
A good programmer should always check warnings.
@@maxaafbackname5562 Correct about removing the difference.
As always in software development, the only hard rule should be "use your brain". But there are lots of inexperienced developers around, so another rule may be "try to compile without any warnings; if you don't find out how, ask a senior developer, who may grant an exception."
Also your code is no longer valid C program. You can write to address zero, but cannot write to null pointer in standard compliant C. (Btw NULL doesn't need to be 0x00000000). Only after then, you can start worrying about HW and SW exceptions / interrupts / signals / SEH / whatever.
Well, Atari OS with cc65 will let your do it without HW or SW fault. Of course int is only 16 bit on this particular system so the 32 bit number you write will be truncated.
Jacob, Great video. IIs there a function to free memory used by mmap? I know there is a munmap function. Is it a good practice to munmap the memory when finished. Do you get a memory leak if you don't call munmap? Thanks for the videos, Cheers
Yes, munmap is the counterpart to mmap.
If memory is not unmapped (similar to when you do not free malloced memory), the memory will stay allocated until it is either unmapped or the process exits.
On modern operating systems, if the process is about to exit, calling munmap for mmapped memory and free for malloced memory is unnecessary since the OS will deallocate the memory for you when cleaning up the process.
It is often considered good practice to do it anyway, even if the process dies, since it can help in the search for memory leaks that grow during runtime, but it might not be possible in some cases.
Examples of applications that often do not free or unmap allocated memory are computer games since doing so would make exiting the game significantly slower while providing no benefit over not doing it.
in case of i686 systems, - physical 0x00 mapped to real mode interrupt vector that is used by bios, which can be rewritten if you're out of real mode. in case of operating systems its kinda just too finicky, and you cant easily divide it into pages, as later bootsector memory comes in, so, you would need to relocate it or not need it and etc.
The boot sector load location in memory is irrelevant because its only executed once and there is no return pointer placed on any stack when the loader branches to the kernel loader - its a jump not a call
@@styleisaweapon it depends on what you're doing, you can make a call, or jump from there. also there might be some data, not just code
@@tochka832 none of what you are saying matters unless you think its really important to explain that the boot sector which only gets executed once gets overwritten after it is executed ... please just stop .. its not important and you arent getting cookies for your efforts here quite the opposite
I don't know enough about linker scripts myself, but could you maybe get the linker to map some writable memory at NULL? And/Or Handcraft an ELF executable that would map something writable to the first memory page.
Pretty sure you can, but i think the kernel would refuse to load that program, at least if run without privileges
You can't write to NULL, but you can write to /dev/null.
In windows its called recycle bin
But you only tried a normal program running in ring 3. What about kernel module running in ring 0?
you can do it in kernel by writing the page tables yourself
Not sure how Linux/Mac do it but Windows actually maps first 64 Kb (this "safety" granula) with R/W protection but does not allow to change it.
Videos about linker scripts would be great
I've heard that on some microcontrollers you can write to NULL
Who else got a unison content ad
I wanna know why we chose 0 to be null instead of -1 (aka a pointer entirely filled with FF)
-1 is typically passed as an "invalid index" sentinel soo. blah.
Probably because you can check for 0 in one instruction (bne) but you can't do that for -1
@@Starwort Depends on the architecture. Under x86, that is not the case.
@@ValverdeHD well yes of course it depends on the instruction set; are you saying there's an x86 instruction to branch on -1? I haven't seen one, but it's not impossible
Edit: C was originally made to be a more ergonomic assembly language for the PDP set of computers, and I'm fairly sure those had a bne instruction but no specialised branches outside of zero and flags
We didn't. The value of NULL ist implementation defined. And in the early days a few operating system did indeed use -1. But with the rise the x86 architecture 0 became the de facto standard.
@@Starwort I never wrote that there is one. What I am saying is that there is no such instruction for a check for 0 either and both a branch that checks for 0 and one that checks for -1 require two instructions.
Wouldn't the first page include data, text, or stack related stuff? Or CRT0 program loader details? Seems you'd want only root access to that.
On modern operating systems with virtual memory, there is (usually) nothing there.
@@ValverdeHD if nothing is there, where are argc, argv, _start and _exit? I thought the first page. Maybe we should print the argc pointer?
@@ValverdeHD Also, where is the ELF header?
@@dgholstein some where in the memory.. OS knows .. OS gives you virtual memory addresses and have its own mapping to your addresses and real addresses.
And you probably confusing the relative address of stack with actual address?
@@dgholstein _start and _exit somewhere defined by the binary, but not 0. (_start is usually in the .text section and _exit is either in .text or in a shared library)
argv under Linux is on the stack of the first thread, which under x86_64 systems should be an address that looks similar to 0x7fXXXXXXXXXX (where X are some hexadecimal digits).
argc is an integer, so depending on the calling convention it's either on the stack or in a register at the time of the function call (if you print the address to it in C you will get a stack address).
So the answer is yesn't.
That's interesting.
You should try it on more then just mac and linux. Maybe something like Windows 11 for a change (---:
"Some" (many ...) years ago I tried to code something similar to DOSEMU, thus using the vm86plus syscall on Linux. There, it was needed (IIRC ...) to MAP some memory at the beginning of the address space from the process' viewpoint, ie "from NULL" , so I can pass that to vm86 mode to my crude "DOS emulator". IIRC it required being root this to work at all, and MAP_FIXED to be specified to mmap().
In most assembly, zero register is always zero
In C, null is zero and points to nothing
In UNIX, /dev/null is a virtual device that takes any std input and do nothing and give zero when asked
C does not define null to be zero - thats implementation specifics that might break elsewhere if you assume - fairly safe assumption until it isnt
This guy doesn't pay his electricity ⚡ bill!
int main without return 0;
I had a stroke.
Completely valid in both C and C++.
It will implicitly return 0 at the end of the function, but this only works for main.
@@ValverdeHD Still a bad practice.
@@finmat95 It really, really does not matter.
@@Shakephobiaful Still cringe
@@finmat95 If you're so pedantic about it, you should probably use return EXIT_SUCCESS; instead.
1
True because 1!=0