Chapter 8 heap overflow attacks
the unauthorized reproduction in whole or in part of this publication in any form is prohibited.
Let's copy the required files into the temporary directory
will now have a look at the program in the example it uses a few memory areas depending on how the data
are located.
Let's compile and analyze our program in the example
as we can see the program has specified all used memory areas
thanks to the RBJ dump application.
And we can also gain insight into every memory area and analyze the code located in.
Now we will familiar lies ourselves with another example in this case operating only in the hip area.
In the program the R.K. function has been used to change the heap size.
Let's check how this function works.
The function determines the end of the data area according to the argument and data segment
the SBIR function was used to obtain current size of the data area which was called with the zero argument
we will now check how the program is functioning
let's now have a look at another example that we will use to demonstrate the overflow in the hip area.
The overflow happened after a perimeter of size above 16 bytes was transferred.
The next example we will see will use the heap overflow.
The program copies the data transfer as a call parameter without checking their length
after entering a call argument.
It was possible to display the content of a file other than the intended file
if the suspectible program is working with the privileges of the system administrator.
It is possible to read any file.
Now let's try another example to demonstrate the use of overflow in the BSM area.
Let's try to change the course of the program in a way that instead of adding it divides
as we can see when transferring an invalid argument the application ended with an error.
The program tried to jump to an area that was not located in its address space.
We can check the address of the F div division function and change the course of the program.
We did it despite the add argument.
The program performed the division operation which is visible on the screen.
Now we will use our own shellcode to take advantage of the error in the example program.