当前位置:网站首页>On buffer overflow

On buffer overflow

2020-11-08 21:30:57 Manong up2u

        Recently, a friend learned about information security , Then send me a question to discuss with me , Although it feels simple , But it's actually interesting , Just take it out and have a look . The title is as follows :

        You can see a paragraph in the picture C Code of language , You can see 3 A question . Here I'll bring up the code , The code is as follows :

 1 #include <stdio.h>
 2 
 3 int main(int argc, char* argv[])
 4 {
 5     int apple;
 6 
 7     char buf[9];
 8 
 9     gets(buf);
10 
11     if (apple == 0x64636261) 
12     {
13         printf("hello world!");
14     }
15 
16     return 0;
17 }

I'll write down the questions as well , There are three questions :

(1) Analyze what kind of overflow it is

(2) Give the variables of the topic apple The address of , for example 0x0012ff44, give buf The address of each character

(3)a、b、c、d Of ASCII  The code values are respectively 0x61、0x62、0x63 and 0x64 , give buf Input mode , So that the program can output hello world

 

What is a buffer

        In short , A buffer is an area of memory where data is stored . According to the allocation of memory for storing data , Memory can be divided into stack memory and heap memory .

        Stack memory , Used to store local variables 、 Parameters of functions, etc , For the protection of the scene when the function is called , Stack memory is also used , For example, save the return address of the function . Stack memory , from CPU To maintain , stay 32 Bit operating system , from CPU Of EBP and ESP Two registers to maintain .

         Heap memory , It's a programmer who applies through specific functions , such as malloc and new Such as function . After the heap memory request, the programmer releases it . and Stack memory As the function returns Stack memory It will also be automatically recycled .

 

What is buffer overflow

        It's usually memory coverage , Because the buffer is divided into Stack and Pile up , So the buffer overflow is divided into   Stack overflow   and   Heap overflow . because C/C++ Many functions don't check memory boundaries in the early days , All memory boundary checking is done by the programmer himself . This may cause buffer overflow due to negligence . And now , Most of the functions that operate memory , Security check is added to the previous function , It's safer than before .

         Some safety books think , Avoid buffer overflows , Don't use stack memory , Instead of using heap memory , This kind of understanding is wrong . Because improper use of heap memory can also cause overflow , There are also security risks .

 

Buffer overflow attack

         The essence of buffer overflow attacks is that data is run as code . In programs that have buffer overflow attacks , The attacker puts executable code into memory as data , And then make the implanted data run in a specific way , So as to achieve the purpose of attack .

 

title

        With the bedding on it , Let's talk about the content of the topic .

        The first question is , What kind of overflow is the above code . You can see in the code that , Array buf[9] It's a buffer , and buf Is a local variable . Local variables are stored in the stack . In code gets() Function is a function that receives user input , But it doesn't check memory boundaries .buf[9] The length of is 9 Bytes , But when used gets() Function to get user input , When more than 9 Bytes , It will also receive all of them . This creates a buffer overflow , More specifically , Stack overflow . This is C/C++ Characteristics of language , Array out of bounds is allowed , Because in a lot of programming , In order to store indefinite data , You're going to use an array out of bounds .

 

        The second question is , If apple The memory address of is 0x0012ff44, So give me buf The address of each character in . A variable is equivalent to giving a name to the first address of a memory , The type of the variable limits the memory length of the variable , such as 0x0012ff44 This is a memory address , Give this memory address a name apple, in addition   Variable apple The type is int, Then limit the length of the variable 4 Bytes .

          The title of the second question is , It's about giving us apple The address of , Then let's write buf The address of the variable . Here we need to know two more things . First , The local variable is in the stack address, which is known , The growth direction of stack address is from high to low . second , stay C In language , A local variable defined within a function , The memory address in the stack is allocated according to the order of variable definition . that , In the code , Defined first apple , Later defined buf Variable . that ,apple The address of is better than buf The address should be high ( Big 、 On ), Pictured .

         After knowing the above two points , that buf What's the address ? Let's start with apple Address actually occupied ,apple The address of the variable is 0x0012ff44, This address is actually apple The first address of the variable , because 0x0012ff44 It represents only one byte of memory space , and apple yes int Variable of type , Occupy 4 Bytes , that apple What is actually occupied is 0x0012ff44、0x0012ff45、0x0012ff46 and 0x0012ff47 Four memory spaces , That is to say 4 Bytes . and apple The first address is 0x0012ff44.

         Besides, buf Variable ,buf For the definition of char buf[9], shows buf Occupy 9 Bytes , and  buf stay apple Defined later , that buf The address in the stack memory must be less than apple Of the address of . Is that just using apple Minus the address of 9 Namely buf What's the address? ? Not yet . although buf Occupy 9 Bytes , But in 32 Bit CPU in , Data in memory is generally in accordance with 4 Byte aligned (32 It's just right 4 Bytes ). that , That is, through  0x0012ff44 - 0xC Namely buf The first address . The memory structure is shown in the figure below .

        In the diagram above , The part marked in red , Namely buf Variable memory , The part marked green , It is apple Variable memory . The white memory , It's the memory used to align . Is this a waste of memory . Yes ! stay 32 A system. , Memory press 4 Byte alignment ,CPU Access speed is the fastest . therefore , waste 3 Bytes for memory alignment , In exchange for CPU Read faster , It's worth it . In computer algorithms , Two sentences are often mentioned ,“ Trade space for time ” and “ Trade time for space ”, This is obviously “ Trade space for time ” The situation of . As can be seen from the figure above ,buf The starting address of is 0x0012ff38.

 

        Third question , Is to let the program output “hello world” This string . But from the code , Only in apple be equal to 0x64636261 When , Will be output "hello world" character string . And there's no right in the whole code apple The code that makes the assignment . and 0x64636261 What is it again? ? Give a hint in the title of the third question ,0x61 For lowercase letters a Of ASCII code ,0x62 For lowercase letters b Of ASCII code . that , That is to say, let apple Filled with letters abcd that will do . Look at the picture below .

         As long as we're giving buf adopt gets assignment , More than 9 Characters , To cover the memory behind it . So how many characters do you need to enter ?buf Is the length of the 9 Bytes , The aligned bytes are 3 Bytes ,apple Is the length of the 4, So input a total of  16 Only characters , front  12 Random input , Last 4 Inputs abcd that will do .

        wait , In the code apple == 0x64636261, look apple The comparison is dcba, But why the input is abcd Well ? It's a matter of byte order , There is no discussion here , As long as you understand the problem of byte order , You can understand , And byte order is used in the development of network programs and reverse analysis , It's the foundation of the foundation .

 

demonstration

         This procedure , I use XP + VC6 To demonstrate . Why use VC6, Because in the new version of VS in , No more gets Function , Because it's not safe , So it was discarded .

        Enter the code above VC6 in , And then use DEBUG Compile (Release Compiled words , The generated binaries are optimized , Memory structure is not obvious , There are also different ways of spillover , Because it's a test question , The simplest way to show the problem is to ).

         After compiling , stay  gets() Set breakpoints at , Then open the “watch” window , Take a look at apple and buf Memory address of , Here's the picture .

        It can be seen that ,apple The address is 0x0012ff7c,buf The memory address of is 0x0012ff70. Is there any doubt ? Different from the address in the title ! Don't worry. ! The same program in different operating systems ( such as ,XP and Win7) The memory addresses of variables on are different , Even in patching different systems (XP SP2 and XP SP3) It can be different . however , Let's pay attention to two points , First of all ,apple The address of buf The address is big , second ,apple Address and buf The address difference of  0xC. Just look at it from these two points , It's the same as what we analyzed earlier .

 

         Then open “memory” window , Look at memory , Here's the picture .

        next , stay if At the lower breakpoint , And let the program run , So we can input , Here's the picture .

         I have entered 12 individual 1, Because of the former 12 You can type in as many characters as you like , And then I entered abcd, Press enter when input is complete , We are if The breakpoint set at position is broken , Now look at the memory , Here's the picture .

         You can see from the above picture that , stay 0x0012ff7c Location , That is to say apple In the stack space , Be filled with 0x61、0x62、0x63 and 0x64. Although there is no place in the program for apple Variable assignment , But we've covered... By spillover apple Memory address of , It was successfully assigned a value . Let the program run , Watch the program run , Here's the picture .

        You can see , character string “hello world” Is the output .

 

summary

         The whole topic has been analyzed above , No difficulty , It's just some basic knowledge . What practical significance does this kind of topic have ? Take the code of this topic as an example , If gets Received a string of passwords , Only if the password is correct , To perform specific functions , And whether the password is right or not may have a flag bit . So in time, you don't know the correct password , As long as the overflow to cover the flag bit is not able to perform a specific function ? Of course, this is just a simple example . For buffer overflow 、SQL Inject 、XSS Such attacks , Their problems are caused by lax inspection   External input data is treated as code Yes , And then there's the question of security . therefore , They are essentially the same . therefore , For programmers , Just can't trust any external input , Be sure to check the external input strictly .

 

版权声明
本文为[Manong up2u]所创,转载请带上原文链接,感谢