2.8.2 緩沖區(qū)溢出實(shí)例分析

緩沖區(qū)溢出原理驗(yàn)證函數(shù)調(diào)用的過程#include"stdafx.h"#include"stdio.h"intBFunc(inti,intj){ intm=1; intn=2; m=i; n=j; return7;}intAFunc(inti,intj){ intm=3; intn=4; m=i; n=j; BFunc(3,4); return8;}intmain(){ AFunc(5,6); return0;}驗(yàn)證函數(shù)調(diào)用的過程用VisualStudio2005編譯用ImmunityDebugger進(jìn)行反編譯Main函數(shù)AFunc函數(shù)緩沖區(qū)溢出樣例程序(VisualC++6.0)#include"stdio.h"#include"string.h“intk;voidfun(constchar*input){ charbuf[8]; inta,b; strcpy(buf,input); a=(int)&input; b=(int)buf; k=a-b; printf("%d\n",a); printf("%d\n",b);}voidshellcode(){ printf("\nOK!success\n");}intmain(intargc,char*argv[]){ printf("Addressoffun=%p\n",fun); printf("Addressofshellcode=%p\n",shellcode); voidshellcode(); intaddr[4]; chars1[]=“hello"; fun(s1); intshellcode_addr=(int)&shellcode; //由于EIP地址是倒著表示的，所以首先把shellcode()函數(shù)的地址分離成字節(jié)

addr[0]=(shellcode_addr<<24)>>24; addr[1]=(shellcode_addr<<16)>>24; addr[2]=(shellcode_addr<<8)>>24; addr[3]=shellcode_addr>>24; chars2[]="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; for(intj=0;j<4;j++){ s2[k-j-1]=addr[3-j]; } fun(s2); return0;}緩沖區(qū)溢出樣例程序運(yùn)行結(jié)果1244876:buf[00]1244877:buf[01]1244878:buf[02]1244879:buf[03]1244880:buf[04]1244881:buf[05]1244882:buf[06]1244883:buf[07]1244884:1244885:1244886:1244887:1244888:eip11244889:eip21244890:eip31244891:eip41244892:input11244893:inpu