stack allocation and buffer overflow

UNIVERSITY OF SOUTH CAROLINAUNIVERSITY OF SOUTH CAROLINADepartment of Computer Science and

Engineering

Department of Computer Science and Engineering

Stack allocation and buffer overflow

CSCE 531 Presentationby

Miao [email protected]

file:///tt/file_convert/56813b01550346895da39f31/document.ppt


Engineering


Outline

• Stack allocation in Windows

• What is buffer overflow

• How to exploit buffer overflow

• Demo


Engineering


Stack allocation in TAM

SB

LB

ST

callframe

SB = Stack baseLB = Locals baseST = Stack top

callframe Dynamic link

globals


Engineering


Stack allocation in TAM (Contd.)

A frame contains• A dynamic link: to next frame on

the stack (the frame of the caller)• Return address• Local variables for the current

activation

return address

locals

Link data

Local data

LB

ST

link


Engineering


What’s going on inside Windows?

• Initial stack state

EBP

ESP

EBP: Extended Base PointerESP: Extended Stack Pointer

Current frame


Engineering



• Before call f(arg1, arg2)– Push arguments

EBP

ESP


Current frame

agr2

arg1


Engineering



• Before call f(arg1, arg2)– Push next instruction address

EBP

ESP


Current frame

agr2

arg1

Ret. Addr.


Engineering



• Enter into f(arg1, arg2)– Push current EBP

EBP

ESP


Current frame

agr2

arg1

Ret. Addr.

Prev. EBP


Engineering



• Enter into f(arg1, arg2)– Move EBP to ESP

EBPESP


Current frame

agr2

arg1

Ret. Addr.

Prev. EBP


Engineering


• Enter into f(arg1, arg2)

EBP

ESP

Previous frame

agr2

arg1

Ret. Addr.

Prev. EBP

Current frame




Engineering


What is buffer overflow?

• Related with stack allocation

• A buffer overflow, or buffer overrun, is an anomaly where a process stores data in a buffer outside the memory the programmer set aside for it.– Wikipedia


Engineering


Buffer overflow

void function(char *str) { char buffer[8]; strcpy(buffer,str); }

void main() { char large_string[256]; for( int i = 0; i < 255; i++) large_string[i] = 'A'; function(large_string); }

void function(char *str) { char buffer[8]; strcpy(buffer,str); }

void main() { char large_string[256]; for( int i = 0; i < 255; i++) large_string[i] = 'A'; function(large_string); }


Engineering


An example


Engineering


An example

Return to 0x41414141


Engineering


Problems with buffer overflow

• A demo


Engineering


Acknowledgement

• The demo and part of this slides are from the training when the presenter was in Symantec, Chinese Development Center, Beijing

• The example comes from the following reference:– Aleph One, Smashing the stack for

fun and profit, Phrack Magzine, Vol. 7 (49) , 1996


Engineering


Questions?


Engineering


stack allocation and buffer overflow

Documents

Binary‐level program analysis: Stack Smashinggxt29/teaching/cse597s19/slides/04StackSmashi… · Buffer Overflow •A buffer overflow occurs when data is written ... Smashing the

Buffer overflow and stack smashing attacks Principles of application software security

Buffer overflow – Smashing The Stack

LN. 6 Buffer Overflow Attacks (2)securesw.dankook.ac.kr/ISS19-2/2019_OS_Se_6_2_Buffer... · 2019-10-06 · Contents Buffer Overflows: Stack Smashing, Heap overflow, Global data overflow

Buffer Overflow Attackscshen/367/notes/Buffer Overflow.pdf · 2016. 2. 9. · Stack Buffer Overflow • Occur when buffer is located on stack – also referred to as stack smashing

Buffer Overflow or Stack smashing

Buffer Overflow Attacks - Donald Bren School of ...stasio/ics8-w12/Week4 - Buffer Overflow Attacks.pdf · Smashing The Stack For Fun And Profit. e-zine #49, 1996 •The attacker exploits

Buffer overflow

Buffer Overflow Attacksecuresw.dankook.ac.kr/.../2019_OS_Se_06_Buffer_Overflow.pdf · 2019-09-30 · •Buffer overflow is a common security flaw •We only focused on stack-based

Stack Overflow - It's all about performance / Marco Cecconi (Stack Overflow)

Noip2 stack buffer overflow

Buffer Overflow Attack

Buffer Overflows and Defenses - Rutgers University...Stack Buffer Overflow occurs when buffer is located on stack used by Morris Worm “Smashing the Stack” paper popularized it

Buffer Overflow and Stack Smashingshmat/courses/cs345/08overflow.pdfBuffer Overflow and Stack Smashing. slide 1. slide 2. Reading Assignment ... Morris Worm and Buffer Overflow One

System Security - Attack and Defense for CSE 610 Special ... Stac… · 1. Stack-based buffer overflow-1 a. Brief history of buffer overflow b. Program variables (global, local, initialized,

Démonstration buffer overflow

Stack overflow

Smashing the Stack Overview The Stack Region Buffer Overflow Shell Program Notes Avoiding Buffer Overflows Conclusion

Buffer Overflow Exploits

[ Apple Quicktime TeXML Stack Buffer Overflow ]index-of.co.uk/Reverse-Engineering/Apple Quicktime TeXML Stack Buffer Overflow [NSHC...해당 모듈은 단순한 버퍼 오버플로우

Buffer Overflows - University of Washington€¦ · L15: Buffer Overflow CSE351, Spring 2017 x86‐64 Linux Memory Layout Stack Runtime stack has 8 MiBlimit Heap Dynamically allocated

Aprenda Stack Buffer Overflow

Stack Buffer Overflow Attack

Buffer OverFlow Exploit

Documento Stack Buffer Overflow

Vitaly Shmatikov Buffer Overflow and Stack Smashing slide 1

20 Buffer Overflow

Buffer Overflow and Stack Smashing

CISC 3320 C31b System Security: Threats - GitHub Pages · Protecting from Buffer Overflow •Buffer overflow can be disabled by disabling stack execution or adding bit to page table

· Web viewBOU (Buffer Overflow Utility) Testing for Heap Overflow Conditions: heap.exe Steps for Testing for Stack Overflow in OllyDbg Debugger Testing for Stack Overflow in OllyDbg

Buffer Overflow

Aprenda Stack Buffer Overflow Como Si Estuviera en Primero

Buffer Overflow ou Stack Overrun ou Stack smashing

Stack Based Windows Buffer Overflow

Network Security, 2015-2016 Stack Based Buffer Overflow ... Stack Based Buffer Overflow Exploit Laboratory Report Prepared By: ... In buffer overflow attack an application is manipulated