堆栈溢出调试-gdb-例子

《堆栈溢出调试-gdb-例子》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、CAP6135:MalwareandSoftwareVulnerabilityAnalysisBufferOverflow:ExampleofUsingGDBtoCheckStackMemoryCliffZouSpring20112AStackFrameParametersReturnAddressCallingStackPointerLocalVariables00000000AddressesSPSP+offsetSP:stackpointerBP:base/framepointerCallingstackpointer:previousfunction’sSPBPUsin

2、gGDBtoCheckStackGDBtutorial:https://developer.apple.com/library/mac/#documentation/developertools/gdb/gdb/gdb_toc.htmlhttp://www.yolinux.com/TUTORIALS/GDB-Commands.html#GDB_COMMAND_LINE_ARGSWhencompiletheccode,use“gcc–g…..”sothatGdbcanmatchsourcecodelinenumberwithcodeSomeknowledge:http://en.w

3、ikipedia.org/wiki/X86_assembly_languageRegistereip:instructionpointer,thecurrentpositionofnextexecutableinstructionRegisterebp:stackpointer,thetopofthecurrentstack,usedforaddressinglocalvariable3RelatedGdbCommands:List:listthesourcecodeandeachexecution’scorrespondinglinenumberBreaklinenumber:

4、setbreakpointatthelinenumberRunargv:runtheexecutioncodewiththeparameterargvNext:executethenextlineofcodeBacktrace:showtraceofallfunctioncallsinstackInfoframe:Listaddress,language,addressofarguments/localvariablesandwhichregistersweresavedinframe.ThiswillshowwherethereturnaddressissavedReturna

5、ddressisinRegisterEIPCallingstackpointerisinRegisterEBPx&variable:showtheaddressandvalueofalocalvariable(inhexformat)xaddress:printbinaryrepresentationof4bytesofmemorypointedtobyaddress.4ExampleofUsingGDB#includevoidfoo(char*input){inta1=11;inta2=22;charbuf[7];strcpy(buf,input);}void

6、main(intargc,char**argv){foo(argv[1]);}Question:Whatdoesthestacklooklikebeforestrcpy()?5czou@eustis:~/buffer-code$setarchi686–Rgdb./gdb-example(gdb)list1#include2voidfoo(char*input){3inta1=11;4inta2=22;5charbuf[7];6strcpy(buf,input);7}8voidmain(intargc,char**argv){9foo(argv[1]);10}(g

7、db)break6Breakpoint1at0x8048388:filegdb-example.c,line6.(gdb)run“whatever”Startingprogram:/home/czou/buffer-code/gdb-example"whatever"Breakpoint1,foo(input=0xbffff92e"whatever")atgdb-example.c:6strcpy(buf,input);6Removeaddressrandomizationuse