-
-
[翻译]Exploit 编写系列教程第六篇 绕过Cookie,SafeSeh,HW DEP 和ASLR
-
发表于: 2009-12-8 19:43
-
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
感谢分享， 我个人在实验过程中遇到一个问题， 请解答。
+++++++++++++++++++++++++++++++++++++++++ 测试环境: Windows XP SP3 English Microsoft Visual C++ 2008 Express Edition +++++++++++++++++++++++++++++++++++++++++ [Exploit 编写系列教程.pdf ] [第六篇: 绕过 Cookie,SafeSeh,HW DEP和 ASLR][第144页] 使用Visual C++ 2008 编译下面代码， 如下图所示。
[/B]#include "stdafx.h"
#include "stdio.h"
#include "windows.h"
void GetInput(char* str, char* out)
{
char buffer[500];
try
{
strcpy(buffer,str);
strcpy(out,buffer);
printf("Input received : %s\n",buffer);
}
catch (char * strErr)
{
printf("No valid input received ! \n");
printf("Exception : %s\n",strErr);
}
}
int main(int argc, char* argv[])
{
char buf2[128];
GetInput(argv[1],buf2);
return 0;
}[B]使用Windbg进行调试，显示信息如下: [/B]CommandLine: "C:\Documents and Settings\lab\Desktop\basicbof\basicbof\Debug\basicbof.exe" AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Symbol search path is: SRV*C:\localsymbols*http://msdl.microsoft.com/download/symbols;cache*c:\localsymbols*http://msdl.microsoft.com/download/symbols Executable search path is: ModLoad: 00400000 00419000 basicbof.exe ModLoad: 7c900000 7c9af000 ntdll.dll ModLoad: 7c800000 7c8f6000 C:\WINDOWS\system32\kernel32.dll (574.f5c): Unknown exception - code c0000135 (first chance) (574.f5c): Unknown exception - code c0000135 (!!! second chance !!!) eax=0012fc54 ebx=00000000 ecx=0012fca8 edx=7c90e4f4 esi=7ffd8000 edi=c0000135 eip=7c96478e esp=0012fc54 ebp=0012fca4 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 ntdll!RtlRaiseStatus+0x26: 7c96478e c9 leave[B] 为何没有出现文中覆盖EIP的情况， (908.470): Access violation - code c0000005 (!!! second chance !!!) eax=0000021a ebx=00000000 ecx=7855215c edx=785bbb60 esi=00000001 edi=00403380 eip=41414141 esp=0012ff78 ebp=41414141 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202 41414141 ??   |
|
|
那位大牛贴下原文地址
|
|
|
|
|
|
|
|
|
你的问题有答案了吗 ？我看到这里也有疑问 |
