Programming puzzle at CMU: how to find the location of process control block wrt base of the stack

Question

I read a programming puzzle at CMU from the book Expert C programming: deep C secrets By Peter Van der Linden.

The puzzle stated to code a program to read a file of numbers and print the average. The program must run as fast as possible and the program had to be written in PASCAL or C.

It seems a programmer had created a program that actually took minus three seconds. On scrutinizing, it was found that the programmer knew where the process control block was stored relative to the base of the stack. So, he crafted a pointer to access the process control block and overwrote the "CPU-time-used" with a very high value. The operating system didn't expected such a high value and so, it treated that high positive value as a negative number under the two's complement scheme.

Now, I wanted to know how did he do that. I know that using this code we can find the base address of the stack.

int main()
{
  int i;
  printf("The base value of the stack is %#d", &i);
  return 0;
}

I can understand that the stack grows downwards and base of the stack will be at top of the physical memory. So, the base of the stack will be below the system memory (kernel memory / kernel address space). So, he used stack as the base. But how did he knew where the process control block is stored in the system memory. Moreover, what is the structure of the Process Control Block.

Do anyone know about this.

Answer 1

I don't think it's as straight forward today, with virtual memory and all (my guess; I don't know when the book was written).

My suggestion is to read the classic Smashing the stack for fun and profit to get an intro. If those concepts are new to you, you'll have a blast reading it and learning some really important stuff.

Answer 2

It used to be true in some implementations that *nix mapped the user structure into user space memory and the stack was under it. Today, it's pretty unlikely that this is possible. Sort of related: http://stackoverflow.com/questions/1921485/pseudo-random-stack-pointer-under-linux