2. Part I The Basic Idea

3. software sequence of instructions in memory logically divided in functions that call each other – function ‘IE’ calls function ‘getURL’ to read the corresponding page in CPU, the program counter contains the address in memory of the next instruction to execute – normally this is the next address (instruction 100 is followed by instruction 101, etc) – not so with function call 200 201 202 203 204 100 101 102 103 IE getURL 104 call getURL return result

4. software sequence of instructions in memory logically divided in functions that call each other – function ‘IE’ calls function ‘getURL’ to read the corresponding page in CPU, the program counter contains the address in memory of the next instruction to execute – normally this is the next address (instruction 100 is followed by instruction 101, etc) – not so with function call return result call getURL 200 201 202 203 204 100 101 102 103 104 PC IE getURL

5. 1020 1021 1022 1023 1024 software so how does our CPU know where to return? – it keeps administration – on a ‘stack’ 200 201 202 203 204 100 101 102 103 104 stack PC call getURL return result 103 PC IE getURL stack pointer (SP)  Points to last added entry on the stack

6. real functions  variables getURL () { char buf[10]; read(keyboard,buf,64); get_webpage (buf); } IE () { getURL (); }

7. real functions  variables getURL () { char buf[10]; read(keyboard,buf,64); get_webpage (buf); } IE () { getURL (); } call read 200 201 202 203 100 101 102 103 IE getURL 104 call getURL return result

8. real functions  variables call read 200 201 202 203 100 101 102 103 IE getURL 104 call getURL return result getURL () { char buf[10]; read(keyboard,buf,64); get_webpage (buf); } IE () { getURL (); } stack 103 1022 1023 1024 1019 1021 1020 old FP 1018 1017 1016 1015 1014 1013 1012 1011 1010 frame pointer (FP)  Points to start of this function’s stack frame

9. real functions  variables call read 200 201 202 203 100 101 102 103 IE getURL 104 call getURL return result getURL () { char buf[10]; read(keyboard,buf,64); get_webpage (buf); } IE () { getURL (); } stack 103 1022 1023 1024 1019 1021 1020 old FP 1018 1017 1016 1015 1014 1013 1012 1011 1010

10. real functions  variables old FP call read 200 201 202 203 100 101 102 103 IE 104 call getURL return result stack 103 1022 1023 1024 1019 1021 1020 1018 buf 1017 1016 1015 1014 1013 1012 1011 1010 getURL () { char buf[10]; read(keyboard,buf,64); get_webpage (buf); } IE () { getURL (); } 1009 1008 1007 getURL 300 301 302 303return read

11. real functions  variables call read 200 201 202 203 100 101 102 103 IE 104 call getURL return result stack 103 1022 1023 1024 1019 1021 1020 1018 1017 1016 1015 getURL () { char buf[10]; read(keyboard,buf,64); get_webpage (buf); } IE () { getURL (); } 1014 1013 1012 1011 1010 64 (buf) fd old FP 1009 1008 1007 buf getURL stack 300 301 302 303return read

12. real functions  variables call read 200 201 202 203 100 101 102 103 IE 104 call getURL return result stack 103 1022 1023 1024 1019 1021 1020 1018 1017 1016 1015 getURL () { char buf[10]; read(keyboard,buf,64); get_webpage (buf); } IE () { getURL (); } 1014 1013 1012 1011 1010 old FP 1009 1008 1007 64 (buf) fd buf getURL 202 300 301 302 303return read

13. real functions  variables call read 200 201 202 203 100 101 102 103 IE 104 call getURL return result stack 103 1022 1023 1024 1019 1021 1020 1018 1017 1016 1015 getURL () { char buf[10]; read(keyboard,buf,64); get_webpage (buf); } IE () { getURL (); } 1014 1013 1012 1011 1010 old FP 202 1023 1009 1008 1007 64 (buf) fd getURL 300 301 302 303return read frame pointer (FP)

14. real functions  variables call read 200 201 202 203 100 101 102 103 IE 104 call getURL return result stack 103 1022 1023 1024 1019 1021 1020 1018 1017 1016 1015 getURL () { char buf[10]; read(keyboard,buf,64); get_webpage (buf); } IE () { getURL (); } 1014 1013 1012 1011 1010 old FP 202 1023 1009 1008 1007 64 (buf) fd on “return from read” getURL 300 301 302 303return read

15. real functions  variables call read 200 201 202 203 100 101 102 103 IE 104 call getURL return result stack 103 1022 1023 1024 1019 1021 1020 1018 1017 1016 1015 getURL () { char buf[10]; read(keyboard,buf,64); get_webpage (buf); } IE () { getURL (); } 1014 1013 1012 1011 1010 old FP 202 1023 1009 1008 1007 64 (buf) fd getURL 300 301 302 303return read POP

16. real functions  variables call read 200 201 202 203 100 101 102 103 IE 104 call getURL return result stack 103 1022 1023 1024 1019 1021 1020 1018 1017 1016 1015 getURL () { char buf[10]; read(keyboard,buf,64); get_webpage (buf); } IE () { getURL (); } 1014 1013 1012 1011 1010 old FP 202 1023 1009 1008 1007 64 (buf) fd getURL 300 301 302 303return read

17. real functions  variables call read 200 201 202 203 100 101 102 103 IE 104 call getURL return result stack 103 1022 1023 1024 1019 1021 1020 1018 1017 1016 1015 getURL () { char buf[10]; read(keyboard,buf,64); get_webpage (buf); } IE () { getURL (); } 1014 1013 1012 1011 1010 old FP 202 1023 1009 1008 1007 64 (buf) fd getURL 300 301 302 303return read RET

18. real functions  variables call read 200 201 202 203 100 101 102 103 IE 104 call getURL return result stack 103 1022 1023 1024 1019 1021 1020 1018 1017 1016 1015 getURL () { char buf[10]; read(keyboard,buf,64); get_webpage (buf); } IE () { getURL (); } 1014 1013 1012 1011 1010 old FP 202 1023 1009 1008 1007 64 (buf) fd getURL 300 301 302 303return read

19. Where is the vulnerability?

20. Exploit 103 1022 1023 1024 1019 1021 1020 1018 buf 1017 1016 1015 1014 1013 1012 1011 1010 getURL () { char buf[10]; read(keyboard, buf, 64); get_webpage (buf); } IE () { getURL (); } 1013

21. You may also overwrite other things For instance: – Other variables that are also on the stack – Other addresses – Etc.

22. Memory Corruption Final words Part I We have sketched only the most common memory corruption attack – many variations, e.g.: heap   stack more complex overflows off-by-one But there are others also – integer overflows – format string attacks – double free – etc. Not now, perhaps later… *different kinds