簡單分析了linux下system函數(shù)的相關(guān)內(nèi)容，具體內(nèi)容如下
int__libc_system (const char *line){ if (line == NULL) /* Check that we have a command processor available. It might not be available after a chroot(), for example. */ return do_system ("exit 0") == 0; return do_system (line);}weak_alias (__libc_system, system)代碼位于glibc/sysdeps/posix/system.c，這里system是__libc_system的弱別名，而__libc_system是do_system的前端函數(shù)，進行了參數(shù)的檢查，接下來看do_system函數(shù)。
static intdo_system (const char *line){ int status, save; pid_t pid; struct sigaction sa;#ifndef _LIBC_REENTRANT struct sigaction intr, quit;#endif sigset_t omask; sa.sa_handler = SIG_IGN; sa.sa_flags = 0; __sigemptyset (&sa.sa_mask); DO_LOCK (); if (ADD_REF () == 0) { if (__sigaction (SIGINT, &sa, &intr) < 0) { (void) SUB_REF (); goto out; } if (__sigaction (SIGQUIT, &sa, &quit) < 0) { save = errno; (void) SUB_REF (); goto out_restore_sigint; } } DO_UNLOCK (); /* We reuse the bitmap in the 'sa' structure. */ __sigaddset (&sa.sa_mask, SIGCHLD); save = errno; if (__sigprocmask (SIG_BLOCK, &sa.sa_mask, &omask) < 0) {#ifndef _LIBC if (errno == ENOSYS) __set_errno (save); else#endif { DO_LOCK (); if (SUB_REF () == 0) { save = errno; (void) __sigaction (SIGQUIT, &quit, (struct sigaction *) NULL); out_restore_sigint: (void) __sigaction (SIGINT, &intr, (struct sigaction *) NULL); __set_errno (save); } out: DO_UNLOCK (); return -1; } }#ifdef CLEANUP_HANDLER CLEANUP_HANDLER;#endif#ifdef FORK pid = FORK ();#else pid = __fork ();#endif if (pid == (pid_t) 0) { /* Child side. */ const char *new_argv[4]; new_argv[0] = SHELL_NAME; new_argv[1] = "-c"; new_argv[2] = line; new_argv[3] = NULL; /* Restore the signals. */ (void) __sigaction (SIGINT, &intr, (struct sigaction *) NULL); (void) __sigaction (SIGQUIT, &quit, (struct sigaction *) NULL); (void) __sigprocmask (SIG_SETMASK, &omask, (sigset_t *) NULL); INIT_LOCK (); /* Exec the shell. */ (void) __execve (SHELL_PATH, (char *const *) new_argv, __environ); _exit (127); } else if (pid < (pid_t) 0) /* The fork failed. */ status = -1; else /* Parent side. */ { /* Note the system() is a cancellation point. But since we call waitpid() which itself is a cancellation point we do not have to do anything here. */ if (TEMP_FAILURE_RETRY (__waitpid (pid, &status, 0)) != pid) status = -1; }#ifdef CLEANUP_HANDLER CLEANUP_RESET;#endif save = errno; DO_LOCK (); if ((SUB_REF () == 0 && (__sigaction (SIGINT, &intr, (struct sigaction *) NULL) | __sigaction (SIGQUIT, &quit, (struct sigaction *) NULL)) != 0) || __sigprocmask (SIG_SETMASK, &omask, (sigset_t *) NULL) != 0) {#ifndef _LIBC /* glibc cannot be used on systems without waitpid. */ if (errno == ENOSYS) __set_errno (save); else#endif status = -1; } DO_UNLOCK (); return status;}do_system首先函數(shù)設(shè)置了一些信號處理程序，來處理SIGINT和SIGQUIT信號，此處我們不過多關(guān)心，關(guān)鍵代碼段在這里
#ifdef FORK pid = FORK ();#else pid = __fork ();#endif if (pid == (pid_t) 0) { /* Child side. */ const char *new_argv[4]; new_argv[0] = SHELL_NAME; new_argv[1] = "-c"; new_argv[2] = line; new_argv[3] = NULL; /* Restore the signals. */ (void) __sigaction (SIGINT, &intr, (struct sigaction *) NULL); (void) __sigaction (SIGQUIT, &quit, (struct sigaction *) NULL); (void) __sigprocmask (SIG_SETMASK, &omask, (sigset_t *) NULL); INIT_LOCK (); /* Exec the shell. */ (void) __execve (SHELL_PATH, (char *const *) new_argv, __environ); _exit (127); } else if (pid < (pid_t) 0) /* The fork failed. */ status = -1; else /* Parent side. */ { /* Note the system() is a cancellation point. But since we call waitpid() which itself is a cancellation point we do not have to do anything here. */ if (TEMP_FAILURE_RETRY (__waitpid (pid, &status, 0)) != pid) status = -1; }首先通過前端函數(shù)調(diào)用系統(tǒng)調(diào)用fork產(chǎn)生一個子進程，其中fork有兩個返回值，對父進程返回子進程的pid，對子進程返回0。所以子進程執(zhí)行6-24行代碼，父進程執(zhí)行30-35行代碼。
子進程的邏輯非常清晰，調(diào)用execve執(zhí)行SHELL_PATH指定的程序，參數(shù)通過new_argv傳遞，環(huán)境變量為全局變量__environ。
其中SHELL_PATH和SHELL_NAME定義如下
#define SHELL_PATH "/bin/sh" /* Path of the shell. */#define SHELL_NAME "sh" /* Name to give it. */
其實就是生成一個子進程調(diào)用/bin/sh -c "命令"來執(zhí)行向system傳入的命令。
下面其實是我研究system函數(shù)的原因與重點：
在CTF的pwn題中，通過棧溢出調(diào)用system函數(shù)有時會失敗，聽師傅們說是環(huán)境變量被覆蓋，但是一直都是懵懂，今天深入學(xué)習(xí)了一下，總算搞明白了。
在這里system函數(shù)需要的環(huán)境變量儲存在全局變量__environ中，那么這個變量的內(nèi)容是什么呢。
__environ是在glibc/csu/libc-start.c中定義的，我們來看幾個關(guān)鍵語句。
# define LIBC_START_MAIN __libc_start_main
__libc_start_main是_start調(diào)用的函數(shù)，這涉及到程序開始時的一些初始化工作，對這些名詞不了解的話可以看一下這篇文章。接下來看LIBC_START_MAIN函數(shù)。
STATIC intLIBC_START_MAIN (int (*main) (int, char **, char ** MAIN_AUXVEC_DECL), int argc, char **argv,#ifdef LIBC_START_MAIN_AUXVEC_ARG ElfW(auxv_t) *auxvec,#endif __typeof (main) init, void (*fini) (void), void (*rtld_fini) (void), void *stack_end){ /* Result of the 'main' function. */ int result; __libc_multiple_libcs = &_dl_starting_up && !_dl_starting_up;#ifndef SHARED char **ev = &argv[argc + 1]; __environ = ev; /* Store the lowest stack address. This is done in ld.so if this is the code for the DSO. */ __libc_stack_end = stack_end; ...... /* Nothing fancy, just call the function. */ result = main (argc, argv, __environ MAIN_AUXVEC_PARAM);#endif exit (result);}我們可以看到，在沒有define SHARED的情況下，在第19行定義了__environ的值。啟動程序調(diào)用LIBC_START_MAIN之前，會先將環(huán)境變量和argv中的字符串保存起來（其實是保存到棧上），然后依次將環(huán)境變量中各項字符串的地址，argv中各項字符串的地址和argc入棧，所以環(huán)境變量數(shù)組一定位于argv數(shù)組的正后方，以一個空地址間隔。所以第17行的&argv[argc + 1]語句就是取環(huán)境變量數(shù)組在棧上的首地址，保存到ev中，最終保存到__environ中。第203行調(diào)用main函數(shù)，會將__environ的值入棧，這個被棧溢出覆蓋掉沒什么問題，只要保證__environ中的地址處不被覆蓋即可。
所以，當(dāng)棧溢出的長度過大，溢出的內(nèi)容覆蓋了__environ中地址中的重要內(nèi)容時，調(diào)用system函數(shù)就會失敗。具體環(huán)境變量距離溢出地址有多遠(yuǎn)，可以通過在_start中下斷查看。
以上就是本文的全部內(nèi)容，希望對大家的學(xué)習(xí)有所幫助，也希望大家多多支持VEVB武林網(wǎng)。
新聞熱點
疑難解答
圖片精選
