缓冲区溢出光速入门（introduction to the speed of light in buffer overflow）

《缓冲区溢出光速入门（introduction to the speed of light in buffer overflow）》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、缓冲区溢出光速入门（Introductiontothespeedoflightinbufferoverflow）BufferoverflowApplication:bufferoverflowininterestbutthemassesalwaysmissthepoint.Author:watercloud@xfocus.orgDate:writtenin2006-2,revisedin2007-9BufferoverflowbaseWhenbufferoverflowsaretypicallywrittent

2、oanarray,thelengthofdatawrittenexceedsthesizeoftheoriginalarraydefinition.Forexample,beforeyoudefinedintbuff[10],thentheonlybuff[0]-buff[9]spaceiswhenwedefinebuffThelegalspaceoftheapplication,butwhenthedataiswritten,thebuff[12]=0x10isoutofbounds.Clanguagecom

3、monlyusedStrcpy,sprintf,strcat,andotherfunctionsareveryeasytocausebufferoverflowproblems.WhenyoulookatbookswritteninClanguage,youusuallytellyouthatunexpectedresultscanoccuraftertheprogramoverflows.InthenetworksecurityTheartofusingbufferoverflowinthewholefiel

4、distomakethisunexpectedoutcomechangetoourdesiredresult.Seethedemobelow:buf.cBufferoverflowexamplebywatercloud@xfocus.org*//*#includeVoidwhy_here(void)/*thisfunctiondoesnotcallanyplace.{Printf("why,u,here,");_exit(0);}Intmain(int,argc,char*argv[]){

5、Intbuff[1];Buff[2]=(int)why_here;Return0;}Onthecommandline,compiledbytheVCcommandlinecompiler(compiledandruninLinuxunderGCC)isthesameresult:C:Temp>clbuf.cRunningprogram:C:Temp>buf.exeWhy,u,here?!Bycarefullyanalyzingtheprogramandprintingtheinformation,youca

6、nseethatwehavenotcalledthewhy_herefunctionintheprogram,butthefunctionhasnotIscalledatruntime!!Theonlyexplanationhereisbuff[2]=why_here;theoperationleadstochangesintheprogramexecutionflow.Toexplainthisphenomenon,youneedtounderstandsomeoftheunderlyingClanguage

7、(andcomputerarchitecturerelated)andsomecompilationknowledge,especially"Stack"andthecompilationof"CALL/RET"knowledge,ifyoustillhavealackofthis,itisrecommendedtorefertorelevantbooks,Otherwise,thecontentwillbehardtofollow.Assumingyoualreadyhaveabasicunderstandi

8、ngofthestack,let'stakealookathowtheprogramworks:Enterthestackafterthemainfunction:[][][EIPEBPbuff[0]]Noproblem.Highlow.Intheabove3storageunits,EIPisthereturnaddressofthemainfunction,andthebuff[0