Windows缓冲区溢出从零开始[0]
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- saved from url=(0045)http://www.yourblog.org/Data/20044/35012.html -->
<HTML><HEAD><TITLE>Windows缓冲区溢出从零开始</TITLE>
<META http-equiv=Content-Type content="text/html; charset=gb2312"><LINK
href="articles/01.css" type=text/css
rel=stylesheet>
<META content="MSHTML 6.00.2900.2523" name=GENERATOR>
</HEAD>
<BODY leftMargin=10 topMargin=10 marginheight="0" marginwidth="0">
<TABLE cellSpacing=0 cellPadding=0 width=580 align=center border=0>
<TBODY>
<TR>
<TD
background="./articles/01view_line.gif"
height=1></TD>
<TD width=559 bgColor=#666666></TD>
<TD width=1 bgColor=#666666 rowSpan=5></TD></TR>
<TR>
<TD width=22
background="./articles/01view_b.gif"
height=5></TD>
<TD></TD></TR>
<TR>
<TD
background="./articles/01view_bg.gif"></TD>
<TD vAlign=top>
<TABLE cellSpacing=0 cellPadding=0 width=550 align=center
border=0>
<TBODY>
<TR>
<TD id=zoom>
<DIV align=left><STRONG><FONT
size=2>Windows缓冲区溢出从零开始[0]</FONT></STRONG> </DIV>
<DIV align=left>作者：coolend
<HR align=center width="98%" color=#666666 SIZE=1>
<DIV align=left>目的：了解缓冲区溢出的原理并简单实现
<DIV align=left>工具：nasm,ollydbg,vc++
<br>
<strong>1、</strong>c语言基础<br>
<strong>1.1</strong> c中数据的几个存储区。<br>
1.栈: 有编译器自动分配释放 <br>
2.堆: 一般由程序员分配释放，若程序员不释放，程序结束时可能由OS回收 <br>
3.全局区（静态区）:全局变量和静态变量的存储是放在一块的，初始化的全局变量和静态变量在一块 <br>
区域，未初始化的全局变量和未初始化的静态变量在相邻的另一块区域。 <br>
一般而言： <br>
1. 函数内部的局部自动变量，使用进程或线程的栈空间。 <br>
2. 动态内存分配使用堆空间。不同的操作系统对堆有不同的管理方式。<br>
3. 初始化的全局变量，放在数据段，DATA段。未初始化的全局变量，放在未初始化数据段，一般为BSS段。</p>
vc++6.0中建一个Win32 console Application，输入如下内容。<br>
<TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
bgColor=#cccccc border=0>
<TBODY>
<TR>
<TD
style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
bgColor=#eeffee><BR>
#include <stdio.h><br>
#defined BUFFERLEN 100<br>
int gGlobal = 0; <br>
int *gpPoint; <br>
main() <br>
{ <br>
int mVar1; <br>
char mVar2[] = "qazqazqaz"; <br>
char *pPoint1; <br>
char *pPoint2 = "qazqazqaz"; <br>
static int mConst = 0； <br>
pPoint1 = (char *)malloc(BUFFERLEN*sizeof(char)); <br>
pPoint2 = (char *)malloc(BUFFERLEN*sizeof(char)); <br>
printf("0x%08x\n",&gGlobal);<br>
printf("0x%08x\n",&gpPoint);<br>
printf("0x%08x\n",&mVar1);<br>
printf("0x%08x\n",&mVar2);<br>
printf("0x%08x\n",&pPoint1);<br>
printf("0x%08x\n",&pPoint2);<br>
printf("0x%08x\n",&mConst);<br>
printf("0x%08x\n",pPoint1);<br>
printf("0x%08x\n",pPoint1);<br>
} </TD>
</TR>
</TBODY>
</TABLE> <br>
输出： <TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
bgColor=#cccccc border=0>
<TBODY>
<TR>
<TD
style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
bgColor=#eeffee>0x00406910<br>
0x00406acc<br>
0x0012ff7c<br>
0x0012ff70<br>
0x0012ff68<br>
0x0012ff6c<br>
0x00406914<br>
0x00410510<br>
0x00410510</TD>
</TR>
</TBODY>
</TABLE>
<br>
说明： <TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
bgColor=#cccccc border=0>
<TBODY>
<TR>
<TD
style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
bgColor=#eeffee>堆： *pPoint1,*pPoint2<br>
栈： mVar1,mVar2,pPoint1,pPoint2<br>
DATA段： gGlobal,mConst <br>
BSS段： gpPoint</TD>
</TR>
</TBODY>
</TABLE> <br><strong> 1.2</strong>c语言中函数调用机制<br>
vc++6.0中建一个Win32 console Application，输入如下内容。<br>
<TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
bgColor=#cccccc border=0>
<TBODY>
<TR>
<TD
style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
bgColor=#eeffee>//example.c<br>
int add(int number1,int number2)<br>
{<br>
int result = 0;<br>
result = number1 + number2;<br>
return result;<br>
}<br>
int main(int argc, char* argv[])<br>
{<br>
int a,b,res=0;<br>
a = 0x100;<br>
b = 0x200;<br>
res = add(a,b);<br>
return 0;<br>
}</TD>
</TR>
</TBODY>
</TABLE> <p> 在res = add(a,b);处设断点，F5，再Alt+8，看到如下的汇编代码。<br>
main函数的汇编代码：<br>
<TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
bgColor=#cccccc border=0>
<TBODY>
<TR>
<TD
style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
bgColor=#eeffee>main:<br>
00401060 55 push ebp<br>
00401061 8B EC mov ebp,esp<br>
00401063 83 EC 4C sub esp,4Ch<br>
00401066 53 push ebx<br>
00401067 56 push esi<br>
00401068 57 push edi<br>
00401069 8D 7D B4 lea edi,[ebp-4Ch]<br>
0040106C B9 13 00 00 00 mov ecx,13h<br>
00401071 B8 CC CC CC CC mov eax,0CCCCCCCCh<br>
00401076 F3 AB rep stos dword ptr [edi]<br>
00401078 C7 45 F4 00 00 00 00 mov dword ptr [ebp-0Ch],0<br>
0040107F C7 45 FC 00 01 00 00 mov dword ptr [ebp-4],100h<br>
00401086 C7 45 F8 00 02 00 00 mov dword ptr [ebp-8],200h<br>
0040108D 8B 45 F8 mov eax,dword ptr [ebp-8]<br>
00401090 50 push eax<br>
00401091 8B 4D FC mov ecx,dword ptr [ebp-4]<br>
00401094 51 push ecx<br>
00401095 E8 6B FF FF FF call @ILT+0(add) (00401005)<br>
0040109A 83 C4 08 add esp,8<br>
0040109D 89 45 F4 mov dword ptr [ebp-0Ch],eax<br>
004010A0 33 C0 xor eax,eax<br>
004010A2 5F pop edi<br>
004010A3 5E pop esi<br>
004010A4 5B pop ebx<br>
004010A5 83 C4 4C add esp,4Ch<br>
004010A8 3B EC cmp ebp,esp<br>
004010AA E8 21 00 00 00 call __chkesp (004010d0)<br>
004010AF 8B E5 mov esp,ebp<br>
004010B1 5D pop ebp<br>
004010B2 C3 ret</TD>
</TR>
</TBODY>
</TABLE>
<p> add函数的汇编代码：<br>
<TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
bgColor=#cccccc border=0>
<TBODY>
<TR>
<TD
style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
bgColor=#eeffee>add:<br>
00401020 55 push ebp<br>
00401021 8B EC mov ebp,esp<br>
00401023 83 EC 44 sub esp,44h<br>
00401026 53 push ebx<br>
00401027 56 push esi<br>
00401028 57 push edi<br>
00401029 8D 7D BC lea edi,[ebp-44h]<br>
0040102C B9 11 00 00 00 mov ecx,11h<br>
00401031 B8 CC CC CC CC mov eax,0CCCCCCCCh<br>
00401036 F3 AB rep stos dword ptr [edi]<br>
00401038 C7 45 FC 00 00 00 00 mov dword ptr [ebp-4],0<br>
0040103F 8B 45 08 mov eax,dword ptr [ebp+8]<br>
00401042 03 45 0C add eax,dword ptr [ebp+0Ch]<br>
00401045 89 45 FC mov dword ptr [ebp-4],eax<br>
00401048 8B 45 FC mov eax,dword ptr [ebp-4]<br>
0040104B 5F pop edi<br>
0040104C 5E pop esi<br>
0040104D 5B pop ebx<br>
0040104E 8B E5 mov esp,ebp<br>
00401050 5D pop ebp<br>
00401051 C3 ret</TD>
</TR>
</TBODY>
</TABLE>
<p> 以及<br>
<TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
bgColor=#cccccc border=0>
<TBODY>
<TR>
<TD
style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
bgColor=#eeffee>@ILT+0(?add@@YAHHH@Z):<br>
00401005 E9 16 00 00 00 jmp add (00401020)<br>
@ILT+5(_main):<br>
0040100A E9 51 00 00 00 jmp main (00401060)</TD>
</TR>
</TBODY>
</TABLE>
<p> 刚才按F5，程序停在0040108D 8B 45 F8 mov eax,dword ptr [ebp-8]，
<br> 再按F10到00401095 E8 6B FF FF FF call @ILT+0(add) (00401005)，
<br> 接着按F11，看到[esp]里是不是显示9A 10 40 00 00，这说明call ******
<br> 相当于push call下面一条指令的地址，再jmp ******
<TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
bgColor=#cccccc border=0>
<TBODY>
<TR>
<TD
style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
bgColor=#eeffee>堆： *pPoint1,*pPoint2<br>
栈： mVar1,mVar2,pPoint1,pPoint2<br>
DATA段： gGlobal,mConst <br>
BSS段： gpPoint</TD>
</TR>
</TBODY>
</TABLE> <p> </p>
<p> </p> <p> </p>
<p> </p>
<p><BR>
</p> </TD></TR>
<TR>
<TD style="PADDING-TOP: 16px" align = center><FONT color=#ff6600>...待续...</FONT></TD></TR></TBODY></TABLE></TD></TR>
<TR>
<TD width=22
background="./articles/01view_b.gif"
height=5></TD>
<TD></TD></TR>
<TR>
<TD
background="./articles/01view_line.gif"
height=1></TD>
<TD bgColor=#666666 height=1></TD></TR></TBODY></TABLE>
