Windows Vista Exploitation Countermeasures.pptVIP

The majority of currently exploited vulnerabilities in Microsoft products are overflows into heap memory Heap exploitation relies on corrupting heap management data or attacking application data within the heap Class objects contain a list of function pointers for each virtual function in the class called a vtable class MyClass { public: MyClass(); virtual ~MyClass(); virtual MemberFunction(); int MemberVariable; }; Overwriting virtual function pointers is the simplest method of heap exploitation VTable Overwrites HEAP_ENTRY Overflow Scenario: Heap-based buffer overflow allows for