MIPS (32-bit)

MIPS architecture overviewtams.informatik.uni-hamburg.de

https://www.dsi.unive.it/~gasparetto/materials/MIPS_Instruction_Set.pdf

Registers

https://tams.informatik.uni-hamburg.de/applets/hades/webdemos/mips.html

Memory layout

At the start of each function, a stack portion will be allocated by decrementing the value of the sp (stack pointer) register:

addiu  sp,sp,-0x1234

Subsequently, the register values s0 to s7 , gp and ra will be saved in the stack:

Note that the relative offsets may vary

sw     ra,local_8(sp)
sw     s7,local_c(sp)
sw     s6,local_10(sp)
sw     s5,local_14(sp)
sw     s4,local_18(sp)
sw     s3,local_1c(sp)
sw     s2,local_20(sp)
sw     s1,local_24(sp)
sw     s0,local_28(sp)
sw     gp=>_gp,local_50(sp)                             

The MIPS assembly displayed above are from Ghidra

• Consider the following instruction:

sw     ra,local_8(sp)

• local_8 refers to Stack[-0x8] (as shown in Ghidra)

  • This is equivalent to stack frame size - 0x8

• Thus, local_8(sp) = SP + stack frame size - 0x8

  • The ra register will be stored in the calculated memory address

The following displays how it would look like normally:

sw      ra,2140(sp)
sw      s7,2136(sp)
sw      s6,2132(sp)
sw      s5,2128(sp)
...

When the function is returned, the following happens:

1. Restore ra and s0 to s7 registers

2. Jump to address stored in ra (saved in stack previously)

3. Restore stack pointer value (increment back to original before function call)

lw         ra,local_8(sp)
lw         s7,local_c(sp)
lw         s6,local_10(sp)
lw         s5,local_14(sp)
lw         s4,local_18(sp)
lw         s3,local_1c(sp)
lw         s2,local_20(sp)
lw         s1,local_24(sp)
lw         s0,local_28(sp)
jr         ra
_addiu     sp,sp,0x1234

Example

Given a function func1, which calls another function func2. Suppose the variables func1_var2, func1_var2 and func2_var1, func2_var2 are created in func1 and func2 respectively

The memory layout diagram below displays how the saved return address (ra register) and local variables will look like:

Notice the following:

1. New variables will be written starting from lower memory addresses, and towards higher memory addresses

• Without bounds checking, an attacker may be able to overwrite saved return address values at higher memory address