1. CSC 495/583 Topics of Software Security Stack Overflows
Class5
CSC 495/583 Topics of Software Security Stack Overflows
Dr. Si Chen

2. Review

4. System Call

5. System Call User code can be arbitrary
User code cannot modify kernel memory
The call mechanism switches code to kernel mode

6. System Call 

7. Example: Hello World
helloworld.asm

8. “Memory Corruption”
What is it?

9. “Memory Corruption”
Modifying a binary’s memory in a way that was not intended
Broad umbrella term for most of what the rest of this class will be
The vast majority of system-level exploits (real-world and competition) involve memory corruption

10. Buffers
A buffer is defined as a limited, contiguously allocated set of memory. The most common buffer in C is an array.

11. Buffers
A buffer is defined as a limited, contiguously allocated set of memory. The most common buffer in C is an array.

12. A novice C programmer mistake
This example shows how easy it is to read past the end of a buffer; C provides no built-in protection.

13. Another C programmer mistake
Our compiler gives us no warnings or errors!!

14. Crash report

16. Stack Frame

17. Overflow.c

18. Overflow.c

19. gdb GNU Debugger - Basics disassemble main (disas main)
set disassembly-flavor intel
break main (b main)
run
stepi (s), step into
nexti (n), step over

20. GNU Debugger – Examine Memory
Examine memory: x/NFU address
N = number
F = format
U = unit
• Examples
x/10xb 0xdeadbeef, examine 10 bytes in hex
x/xw 0xdeadbeef, examine 1 word in hex
x/s 0xdeadbeef, examine null terminated string

21. Overflowing array results in overwriting other items on the stack

22. Overflow.c

23. Print ABCD

24. Print 100A(s)

25. BASH refresher

26. gdb io

27. Q & A