Interpreting this line in Assembly language?

Question

Below are the first 5 lines of a disassembled C program that I am trying to reverse engineer back into it's C code for purposes of better learning assembly language. At the beginning of this code I see it makes room on the stack and immediately calls

0x000000000040054e <+8>:    mov    %fs:0x28,%rax

I am confused what this line does, and what might be calling this from the corresponding C program. The only time I have seen this line so far is when a different method within a C program is called, but this time it is not followed by any Callq instructions so I am not so sure... Any ideas what else could be in this C program to be making this call?

0x0000000000400546 <+0>:    push   %rbp
0x0000000000400547 <+1>:    mov    %rsp,%rbp   
0x000000000040054a <+4>:    sub    $0x40,%rsp
0x000000000040054e <+8>:    mov    %fs:0x28,%rax
0x0000000000400557 <+17>:   mov    %rax,-0x8(%rbp)
0x000000000040055b <+21>:   xor    %eax,%eax
0x000000000040055d <+23>:   movl   $0x17,-0x30(%rbp)
...

I know this is to provide some form of stack protection for buffer overflow attacks, I just need to know what C code would prompt this protection if not for a seperate method.

Answer 1

As you say, this is code used to defend against buffer overflows. The compiler generates this "stack canary check" for functions that have local variables that might be buffers that could be overflowed. Note the instructions immediately above and below the line you are asking about:

sub  $0x40, %rsp
mov  %fs:0x28, %rax
mov  %rax, -0x8(%ebp)
xor  %eax, %eax

The sub allocates 64 bytes of space on the stack, which is enough room for at least one small array. Then a secret value is copied from %fs:0x28 to the top of that space, just below the previous frame pointer and the return address, and then it is erased from the register file.

The body of the function does something with arrays; if it writes sufficiently far past the end of an array, it will overwrite the secret value. At the end of the function, there will be code along the lines of

    mov    -0x8(%rbp), %rax
    xor    %fs:28, %rax
    jne    1
    mov    %rbp, %rsp
    pop    %rbp
    ret
1:
    call    __stack_chk_fail   # does not return

This verifies that the secret value is unchanged, and crashes the program if it has changed. The idea is that someone trying to exploit a simple buffer overflow vulnerability, like you have when you use gets, won't be able to change the return address without also modifying the secret value.

The compiler has several different heuristics, selectable with command line options, for deciding when it is necessary to generate stack-canary protection code.

You can't write C code corresponding to this assembly language yourself, because it uses the unusual %fs:nnnn addressing mode; the stack-canary code intentionally uses an addressing mode that no other code generation relies on, to make it as difficult as possible for the adversary to learn the secret value.