Memory Corruption The (almost) Complete History... haroon meer - - PowerPoint PPT Presentation

Memory Corruption The (almost) Complete History... haroon meer - 2010 @haroonmeer | haroon@thinkst.com

Who ? haroon meer thinkst ? some papers, some books, some talks academic wannabe

Why?

Why?

Why?

Why?

Why? twitter made me do it!

Why? de-mystify some of the otherwise mystical convince you that Solar Designer was skynet

Why? (Some silly Stats) '!" &!" &#" %#" &!" %!" %#" %!" $#" $#" $!" $!" #" #" !" !" $(((" %!!!" %!!$" %!!%" %!!&" %!!'" %!!#" %!!)" %!!*" %!!+" %!!(" $'''" %!!!" %!!$" %!!%" %!!&" %!!(" %!!#" %!!)" %!!*" %!!+" %!!'" Stack : 140 Heap : 74

Why? (Some silly Stats) '!" &!" &#" %#" &!" %!" %#" %!" $#" $#" $!" $!" #" #" !" !" $(((" %!!!" %!!$" %!!%" %!!&" %!!'" %!!#" %!!)" %!!*" %!!+" %!!(" $'''" %!!!" %!!$" %!!%" %!!&" %!!(" %!!#" %!!)" %!!*" %!!+" %!!'" Stack : 140 Heap : 74

Caveats - Limits

Caveats - Limits

Caveats - Myopia

Caveats - Myopia

Caveats -Compression Ratio 332880 : 1

Disclosure, Bugs and Counts VS.

Disclosed Bugs

Our Approach Clearly naive initially

http://ilm.thinkst.com/folklore/

http://ilm.thinkst.com/folklore/

http://ilm.thinkst.com/folklore/

the paper (read it)

So at the end of this.. You wont be able to suddenly use free() to obtain a 4-byte write anything anywhere primitive. You will understand what that means. You will be able to see: When that was first used; What prevents it’s use/abuse today;

Where did it start?

Memory Basics

Memory Basics

Memory Basics { 0x00000000 User PageTable 4 gig Kernel

Memory Basics { 0x00000000 User PageTable 4 gig Kernel

Multiple Processes { 0x00000000 0x00000000 0x00000000 3 gig User User User Kernel Kernel Kernel

Multiple Processes { 0x00000000 0x00000000 0x00000000 3 gig User User User Kernel Kernel Kernel Kernel

Segments { 0x00000000 PageTable User 4 gig Kernel

Segments { 0x00000000 User 4 gig Kernel

Segments 0x00000000 { 0x00000000 User 4 gig Kernel

Segments 0x00000000 Text { 0x00000000 User 4 gig Kernel

Segments 0x00000000 Text Data { 0x00000000 User 4 gig Kernel

Segments 0x00000000 Text Data ... { 0x00000000 User 4 gig Kernel

Segments 0x00000000 Text Data ... { Grows Upwards Heap 0x00000000 User 4 gig Kernel

Segments 0x00000000 Text Data ... { Grows Upwards Heap 0x00000000 mmap (Shared Memory) User 4 gig Kernel

Segments 0x00000000 Text Data ... { Grows Upwards Heap 0x00000000 mmap (Shared Memory) User 4 gig Grows Stack Downwards Kernel

So what is code?

So what is code?

So what is code?

So what is code?

Is this code?

Is this code?

Is this code?

Is this code?

Is this code?

0x00000000 Text Data ... { Grows Upwards Heap 0x00000000 mmap (Shared Memory) User 4 gig Grows Stack Downwards Kernel

Stack Basics int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; } 0x00000000 mmap Text Data ... Heap Stack (Shared Memory) Grows Grows Upwards Downwards

Stack Basics int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; } 0x00000000 mmap Text Data ... Heap Stack (Shared Memory) Grows Grows Upwards Downwards

Stack Basics int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; } 0x00000000 int argc char **argv char **envp Grows Downwards

Stack Basics int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; } 0x00000000 Saved Saved int argc char **argv char **envp EBP EIP Grows Downwards

Stack Basics int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; } 0x00000000 Saved Saved int argc char **argv char **envp EBP EIP Grows Downwards

Stack Basics int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; } 0x00000000 Saved Saved int i int argc char **argv char **envp EBP EIP Grows Downwards

Stack Basics int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; } 0x00000000 Saved Saved int i int argc char **argv char **envp EBP EIP Grows Downwards

Stack Basics int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; } 0x00000000 function_1 function_1 Saved Saved int i int argc char **argv char **envp argument_1 argument_2 EBP EIP (a) (b) Grows Downwards

Stack Basics int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; } 0x00000000 function_1 function_1 Saved Saved int i int argc char **argv char **envp argument_1 argument_2 EBP EIP (a) (b) Grows Downwards

Stack Basics int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; } 0x00000000 function_1 function_1 Saved Saved Saved Saved int i int argc char **argv char **envp argument_1 argument_2 EBP EIP EBP EIP (a) (b) Grows Downwards

Stack Basics int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; } 0x00000000 function_1 function_1 Saved Saved Saved Saved int i int argc char **argv char **envp argument_1 argument_2 EBP EIP EBP EIP (a) (b) Grows Downwards

Stack Basics int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; } 0x00000000 function_1 function_1 Saved Saved Saved Saved int i int argc char **argv char **envp int j argument_1 argument_2 EBP EIP EBP EIP (a) (b) Grows Downwards

Stack Basics int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; } 0x00000000 function_1 function_1 Saved Saved Saved Saved int i int argc char **argv char **envp argument_1 argument_2 EBP EIP EBP EIP (a) (b) Grows Downwards

Stack Basics int function_1(int a, int b) { int j; // do stuff return j; } int main(int argc, char **argv, char **envp) { int i; i = function_1(1,2); printf(“answer is %d”, i) return i; } 0x00000000 function_1 function_1 Saved Saved int i int argc char **argv char **envp argument_1 argument_2 EBP EIP (a) (b) Grows Downwards

Classic Overflow Where to go function_1 Saved Saved Saved Saved buff int j argument_1 int argc char **argv char **envp EBP EIP EBP EIP (a) Overflow Direction Stack Grows Downwards

non-terminated strings strcpy(buf1, buf2);

non-terminated strings strcpy(buf1, buf2);

non-terminated strings char buf1[4]; strcpy(buf1, buf2); strncpy(buf1, buf2, 4);

non-terminated strings char buf1[4]; strcpy(buf1, buf2); strncpy(buf1, buf2, 4);

non-terminated strings char buf1[4]; strcpy(buf1, buf2); strncpy(buf1, buf2, 4); T E S T I N G \0 char buf1[4] char buf2[] = “TESTING”

non-terminated strings char buf1[4]; strcpy(buf1, buf2); strncpy(buf1, buf2, 4); T E S T T E S T I N G \0 char buf1[4] char buf2[] = “TESTING”