其他语言

本类阅读TOP10
·基于Solaris 开发环境的整体构思
·使用AutoMake轻松生成Makefile
·BCB数据库图像保存技术
·GNU中的Makefile
·射频芯片nRF401天线设计的分析
·iframe 的自适应高度
·BCB之Socket通信
·软件企业如何实施CMM
·入门系列--OpenGL最简单的入门
·WIN95中日志钩子（JournalRecord Hook）的使用

→ 分类导航
VC语言Delphi
VB语言ASP
PerlJava
Script数据库
其他语言游戏开发
文件格式网站制作
软件工程.NET开发
Windows缓冲区溢出从零开始[0]

作者：未知 来源：月光软件站 加入时间：2005-2-28　月光软件站

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- saved from url=(0045)http://www.yourblog.org/Data/20044/35012.html -->
<HTML><HEAD><TITLE>Windows缓冲区溢出从零开始</TITLE>
<META http-equiv=Content-Type content="text/html; charset=gb2312"><LINK
href="articles/01.css" type=text/css
rel=stylesheet>

 


<META content="MSHTML 6.00.2900.2523" name=GENERATOR>
</HEAD>
<BODY leftMargin=10 topMargin=10 marginheight="0" marginwidth="0">
<TABLE cellSpacing=0 cellPadding=0 width=580 align=center border=0>
        <TBODY>
        <TR>
          <TD
          background="./articles/01view_line.gif"
          height=1></TD>
          <TD width=559 bgColor=#666666></TD>
          <TD width=1 bgColor=#666666 rowSpan=5></TD></TR>
        <TR>
          <TD width=22
          background="./articles/01view_b.gif"
          height=5></TD>
          <TD></TD></TR>
        <TR>
          <TD
          background="./articles/01view_bg.gif"></TD>
          <TD vAlign=top>
            <TABLE cellSpacing=0 cellPadding=0 width=550 align=center
              border=0>
              <TBODY>
              <TR>
                <TD id=zoom>

                  <DIV align=left><STRONG><FONT
                  size=2>Windows缓冲区溢出从零开始[0]</FONT></STRONG> </DIV>
                  <DIV align=left>作者：coolend
            <HR align=center width="98%" color=#666666 SIZE=1>   
                  <DIV align=left>目的：了解缓冲区溢出的原理并简单实现                
                  <DIV align=left>工具：nasm,ollydbg,vc++
   <br>
                  <strong>1、</strong>c语言基础<br>
                  <strong>1.1</strong> c中数据的几个存储区。<br>
                  1.栈: 有编译器自动分配释放 <br>
                  2.堆: 一般由程序员分配释放，若程序员不释放，程序结束时可能由OS回收 <br>
                  3.全局区（静态区）:全局变量和静态变量的存储是放在一块的，初始化的全局变量和静态变量在一块 <br>
                  区域，未初始化的全局变量和未初始化的静态变量在相邻的另一块区域。  <br>
                  一般而言： <br>
                    1. 函数内部的局部自动变量，使用进程或线程的栈空间。 <br>
                    2. 动态内存分配使用堆空间。不同的操作系统对堆有不同的管理方式。<br>
                  3. 初始化的全局变量，放在数据段，DATA段。未初始化的全局变量，放在未初始化数据段，一般为BSS段。</p>                 
      &nbsp;vc++6.0中建一个Win32 console Application，输入如下内容。<br>
      <TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
                  bgColor=#cccccc border=0>
                    <TBODY>
                      <TR>
                        <TD
                      style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
                      bgColor=#eeffee><BR>
      
                          #include &lt;stdio.h&gt;<br>
#defined BUFFERLEN 100<br>
int gGlobal = 0; <br>
int *gpPoint; <br>
main() <br>
{ <br>
int mVar1; <br>
char mVar2[] = &quot;qazqazqaz&quot;; <br>
char *pPoint1; <br>
char *pPoint2 = &quot;qazqazqaz&quot;; <br>
static int mConst = 0； <br>
pPoint1 = (char *)malloc(BUFFERLEN*sizeof(char)); <br>
pPoint2 = (char *)malloc(BUFFERLEN*sizeof(char)); <br>
printf(&quot;0x%08x\n&quot;,&amp;gGlobal);<br>
printf(&quot;0x%08x\n&quot;,&amp;gpPoint);<br>
printf(&quot;0x%08x\n&quot;,&amp;mVar1);<br>
printf(&quot;0x%08x\n&quot;,&amp;mVar2);<br>
printf(&quot;0x%08x\n&quot;,&amp;pPoint1);<br>
printf(&quot;0x%08x\n&quot;,&amp;pPoint2);<br>
printf(&quot;0x%08x\n&quot;,&amp;mConst);<br>
printf(&quot;0x%08x\n&quot;,pPoint1);<br>
printf(&quot;0x%08x\n&quot;,pPoint1);<br>
} </TD>
                      </TR>
                    </TBODY>
                  </TABLE>                  <br>
                  &nbsp;输出：                 <TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
                  bgColor=#cccccc border=0>
                    <TBODY>
                      <TR>
                        <TD
                      style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
                      bgColor=#eeffee>0x00406910<br>
0x00406acc<br>
0x0012ff7c<br>
0x0012ff70<br>
0x0012ff68<br>
0x0012ff6c<br>
0x00406914<br>
0x00410510<br>
0x00410510</TD>
                      </TR>
                    </TBODY>
                  </TABLE>                 
                    <br>
                    &nbsp;说明：                  <TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
                  bgColor=#cccccc border=0>
                    <TBODY>
                      <TR>
                        <TD
                      style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
                      bgColor=#eeffee>堆： *pPoint1,*pPoint2<br>
栈： mVar1,mVar2,pPoint1,pPoint2<br>
DATA段： gGlobal,mConst <br>
BSS段： gpPoint</TD>
                      </TR>
                    </TBODY>
                  </TABLE>                  <br><strong>&nbsp;1.2</strong>c语言中函数调用机制<br>
                  &nbsp;vc++6.0中建一个Win32 console Application，输入如下内容。<br>
                  <TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
                  bgColor=#cccccc border=0>
                    <TBODY>
                      <TR>
                        <TD
                      style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
                      bgColor=#eeffee>//example.c<br>
int add(int number1,int number2)<br>
{<br>
int result = 0;<br>
result = number1 + number2;<br>
return result;<br>
}<br>
int main(int argc, char* argv[])<br>
{<br>
int a,b,res=0;<br>
a = 0x100;<br>
b = 0x200;<br>
res = add(a,b);<br>
return 0;<br>
}</TD>
                      </TR>
                    </TBODY>
                  </TABLE>                  <p>&nbsp;在res = add(a,b);处设断点，F5，再Alt+8，看到如下的汇编代码。<br>
                    &nbsp;main函数的汇编代码：<br>
                 
                  <TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
                  bgColor=#cccccc border=0>
                    <TBODY>
                      <TR>
                        <TD
                      style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
                      bgColor=#eeffee>main:<br>
                          00401060 55 push ebp<br>
                          00401061 8B EC mov ebp,esp<br>
                          00401063 83 EC 4C sub esp,4Ch<br>
                          00401066 53 push ebx<br>
                          00401067 56 push esi<br>
                          00401068 57 push edi<br>
                          00401069 8D 7D B4 lea edi,[ebp-4Ch]<br>
                          0040106C B9 13 00 00 00 mov ecx,13h<br>
                          00401071 B8 CC CC CC CC mov eax,0CCCCCCCCh<br>
                          00401076 F3 AB rep stos dword ptr [edi]<br>
                          00401078 C7 45 F4 00 00 00 00 mov dword ptr [ebp-0Ch],0<br>
                          0040107F C7 45 FC 00 01 00 00 mov dword ptr [ebp-4],100h<br>
                          00401086 C7 45 F8 00 02 00 00 mov dword ptr [ebp-8],200h<br>
                          0040108D 8B 45 F8 mov eax,dword ptr [ebp-8]<br>
                          00401090 50 push eax<br>
                          00401091 8B 4D FC mov ecx,dword ptr [ebp-4]<br>
                          00401094 51 push ecx<br>
                          00401095 E8 6B FF FF FF call @ILT+0(add) (00401005)<br>
                          0040109A 83 C4 08 add esp,8<br>
                          0040109D 89 45 F4 mov dword ptr [ebp-0Ch],eax<br>
                          004010A0 33 C0 xor eax,eax<br>
                          004010A2 5F pop edi<br>
                          004010A3 5E pop esi<br>
                          004010A4 5B pop ebx<br>
                          004010A5 83 C4 4C add esp,4Ch<br>
                          004010A8 3B EC cmp ebp,esp<br>
                          004010AA E8 21 00 00 00 call __chkesp (004010d0)<br>
                          004010AF 8B E5 mov esp,ebp<br>
                          004010B1 5D pop ebp<br>
                        004010B2 C3 ret</TD>
                      </TR>
                    </TBODY>
                  </TABLE>
                  <p>&nbsp;add函数的汇编代码：<br>
                  <TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
                  bgColor=#cccccc border=0>
                    <TBODY>
                      <TR>
                        <TD
                      style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
                      bgColor=#eeffee>add:<br>
                          00401020 55 push ebp<br>
                          00401021 8B EC mov ebp,esp<br>
                          00401023 83 EC 44 sub esp,44h<br>
                          00401026 53 push ebx<br>
                          00401027 56 push esi<br>
                          00401028 57 push edi<br>
                          00401029 8D 7D BC lea edi,[ebp-44h]<br>
                          0040102C B9 11 00 00 00 mov ecx,11h<br>
                          00401031 B8 CC CC CC CC mov eax,0CCCCCCCCh<br>
                          00401036 F3 AB rep stos dword ptr [edi]<br>
                          00401038 C7 45 FC 00 00 00 00 mov dword ptr [ebp-4],0<br>
                          0040103F 8B 45 08 mov eax,dword ptr [ebp+8]<br>
                          00401042 03 45 0C add eax,dword ptr [ebp+0Ch]<br>
                          00401045 89 45 FC mov dword ptr [ebp-4],eax<br>
                          00401048 8B 45 FC mov eax,dword ptr [ebp-4]<br>
                          0040104B 5F pop edi<br>
                          0040104C 5E pop esi<br>
                          0040104D 5B pop ebx<br>
                          0040104E 8B E5 mov esp,ebp<br>
                          00401050 5D pop ebp<br>
                        00401051 C3 ret</TD>
                      </TR>
                    </TBODY>
                  </TABLE>                 
                   <p>&nbsp;以及<br>
                  <TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
                  bgColor=#cccccc border=0>
                    <TBODY>
                      <TR>
                        <TD
                      style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
                      bgColor=#eeffee>@ILT+0(?add@@YAHHH@Z):<br>
                          00401005 E9 16 00 00 00 jmp add (00401020)<br>
                          @ILT+5(_main):<br>
                        0040100A E9 51 00 00 00 jmp main (00401060)</TD>
                      </TR>
                    </TBODY>
                  </TABLE>
                  <p>&nbsp;刚才按F5，程序停在0040108D 8B 45 F8             mov         eax,dword ptr [ebp-8]，
      <br>&nbsp;再按F10到00401095 E8 6B FF FF FF       call        @ILT+0(add) (00401005)，
    <br>&nbsp;接着按F11，看到[esp]里是不是显示9A 10 40 00 00，这说明call ******
    <br>&nbsp;相当于push call下面一条指令的地址，再jmp ******
                  <TABLE cellSpacing=1 cellPadding=0 width="98%" align=center
                  bgColor=#cccccc border=0>
                    <TBODY>
                      <TR>
                        <TD
                      style="PADDING-RIGHT: 10px; PADDING-LEFT: 15px; PADDING-BOTTOM: 10px; PADDING-TOP: 10px"
                      bgColor=#eeffee>堆： *pPoint1,*pPoint2<br>
        栈： mVar1,mVar2,pPoint1,pPoint2<br>
        DATA段： gGlobal,mConst <br>
        BSS段： gpPoint</TD>
                      </TR>
                    </TBODY>
                  </TABLE>                  <p>&nbsp;</p>
                  <p>&nbsp;</p>                  <p>&nbsp;</p>
                  <p>&nbsp;                  </p>
                  <p><BR>
                  </p>                  </TD></TR>
              <TR>
                <TD style="PADDING-TOP: 16px" align = center><FONT color=#ff6600>...待续...</FONT></TD></TR></TBODY></TABLE></TD></TR>
        <TR>
          <TD width=22
          background="./articles/01view_b.gif"
          height=5></TD>
          <TD></TD></TR>
        <TR>
          <TD
          background="./articles/01view_line.gif"
          height=1></TD>
          <TD bgColor=#666666 height=1></TD></TR></TBODY></TABLE>

相关文章：

相关软件：