复旦大学软件学院计算机系统课件 Pointers Buffer Overflow.ppt

* * * * * * * * * Stack Corruption Detection Return address Saved %ebp Saved %ebx Canary [7] [6] [5] [4] [3] [2] [1] [0] %ebp buf Stack frame for caller Stack frame for echo * Stack Corruption Detection 1 echo: 2 pushl %ebp 3 movl %esp, %ebp 4 pushl %ebx 5 subl $20, %esp 6 movl %gs:20, %eax Retrieve canary 7 movl %eax, -8(%ebp) Store on stack 8 xorl %eax, %eax Zero out register 9 leal -16(%ebp), %ebx Compute buf as %ebp-16 10 movl %ebx, (%esp) Store buf at top of stack 11 call gets Call gets 12 movl %ebx, (%esp) Store buf at top of stack 13 call puts Call puts * Stack Corruption Detection 14 movl -8(%ebp), %eax Retrieve canary 15 xorl %gs:20, %eax Compare to stored value 16 je .L19 If =, goto ok 17 call __stack_chk_fail Stack corrupted! 18 .L19: ok: 19 addl $20, %esp Normal return ... 20 popl %ebx 21 popl %ebp 22 ret %gs:20 Segmented addressing which appeared in 80286 and seldom used today It is marked as read only * Limiting Executable Code Regions Page 4k bytes As a protected unit by OS Should be marked as “readable”, “writable” and “executable” 3 bits are required Originally Intel merged the “readable” and “executable” into one The exploit code in the stack can be executed AMD introduced “NX” in X86-64 Now there 3 bits How about “JIT”? Code Reuse Attack Return-oriented Programming Find code gadgets in existed code base (e.g. libc) Push address of gadgets on the stack Leverage ‘ret’ to connect code gadgets No code injection Solutions Return-less kernels Heuristic means New Attacks: Jump-oriented Use gadget as dispatcher return addr saved ebp 0101011010 0101011010 0101011010 Address A Address B Address C 0101011010 A B C Motivation: Code Reuse Attack * * * * * * * * * * * * * * * * * * * * * * * * * * Compilers Autumn 2002 Compilers Autumn 2002 * Understanding PointersBuffer Overflow * Outline Understanding Pointers Buffer Overflow Suggested reading Chap 3.10, 3.12 * Pointers Every po