rendered paste body// ------------------------------------------------------- hack1.cpp beginconst size_t buffer_size = 16;const size_t buffer_ret_offset = 8 ;char* buffer_data = "AAAABBBBCCCCDDD"; //"DEEEEFFFFGGGG";void print_mem(unsigned char* mem, const int len, const int bytes_in_line = 8);void stack_func(char* data);// *******************************************************itn main(int argc, char** argv){ stack_func(buffer_data); return 0;}// *******************************************************void stack_func(char* data){ char buffer[buffer_size]; // Staticky vytvoreny buffer strcpy(buffer,data); print_mem((unsigned char*)&buffer+buffer_size+buffer_ret_offset,4); buffer[buffer_size+buffer_ret_offset+0] = 'A'; buffer[buffer_size+buffer_ret_offset+1] = 'A'; buffer[buffer_size+buffer_ret_offset+2] = 'A'; buffer[buffer_size+buffer_ret_offset+3] = 'A'; print_mem((unsigned char*)&buffer+buffer_size+buffer_ret_offset,4);}// *******************************************************void print_mem(unsigned char* mem, const int len, const int bytes_in_line){ printf("MEMORY DUMP BEGIN - 0x%p (%d Bytes)\n",mem, len); for(int i = 0; i < (len/bytes_in_line)+1; i++) // Prizpusobene zpracovani po radcich { for(int j = 0; j < bytes_in_line && (i*bytes_in_line+j < len); j++) { int c = (int)mem[i*bytes_in_line+j]; if(isprint(c)) { printf("%c (0x%02X) ",mem[i*bytes_in_line+j],mem[i*bytes_in_line+j]); } else { printf("%? (0x%02X) ",mem[i*bytes_in_line+j]); } } } printf("\nMEMORY DUMP END\n");}// ------------------------------------------------------- hack1.cpp end// Kod vygenerovany visual studiem pro debug verzi:// -------------------------------------------------------void stack_func(char* data){ 004138C0 push ebp 004138C1 mov ebp,esp 004138C3 sub esp,0DCh 004138C9 push ebx 004138CA push esi 004138CB push edi 004138CC lea edi,[ebp-0DCh] 004138D2 mov ecx,37h 004138D7 mov eax,0CCCCCCCCh 004138DC rep stos dword ptr es:[edi] 004138DE mov eax,dword ptr [___security_cookie (417004h)] 004138E3 xor eax,ebp 004138E5 mov dword ptr [ebp-4],eax char buffer[buffer_size]; // Staticky vytvoreny buffer strcpy(buffer,data); 004138E8 mov eax,dword ptr [ebp+8] 004138EB push eax 004138EC lea ecx,[ebp-18h] 004138EF push ecx 004138F0 call @ILT+170(_strcpy) (4110AFh) 004138F5 add esp,8 print_mem((unsigned char*)&buffer+buffer_size+buffer_ret_offset,4); 004138F8 push 8 004138FA push 4 004138FC lea eax,[ebp] 004138FF push eax 00413900 call print_mem (41110Eh) 00413905 add esp,0Ch buffer[buffer_size+buffer_ret_offset+0] = 'A'; // Pro toto prirazeni za hranice buffferu VYGENEROVAL kod -> normalka! 00413908 mov byte ptr [ebp],41h buffer[buffer_size+buffer_ret_offset+1] = 'A'; // Pro toto prirazeni za hranice buffferu VYGENEROVAL kod -> normalka! 0041390C mov byte ptr [ebp+1],41h buffer[buffer_size+buffer_ret_offset+2] = 'A'; // Pro toto prirazeni za hranice buffferu VYGENEROVAL kod -> normalka! 00413910 mov byte ptr [ebp+2],41h buffer[buffer_size+buffer_ret_offset+3] = 'A'; // Pro toto prirazeni za hranice buffferu VYGENEROVAL kod -> normalka! 00413914 mov byte ptr [ebp+3],41h print_mem((unsigned char*)&buffer+buffer_size+buffer_ret_offset,4); 00413918 push 8 0041391A push 4 0041391C lea eax,[ebp] 0041391F push eax 00413920 call print_mem (41110Eh) 00413925 add esp,0Ch }// Vystup v konzoli - Je videt, ze k prepsani DOSLO!MEMORY DUMP BEGIN - 0x0012FE90 (4 Bytes)h (0x68) ? (0xFF) ? (0x12) ? (0x00)MEMORY DUMP ENDMEMORY DUMP BEGIN - 0x0012FE90 (4 Bytes)A (0x41) A (0x41) A (0x41) A (0x41)MEMORY DUMP END// -------------------------------------------------------//Kod vygenerovany visual studiem pro release verzi:// ------------------------------------------------------- void stack_func(char* data){ 00401020 sub esp,14h 00401023 mov eax,dword ptr [___security_cookie (403000h)] 00401028 xor eax,esp 0040102A mov dword ptr [esp+10h],eax char buffer[buffer_size]; // Staticky vytvoreny buffer strcpy(buffer,data); 0040102E xor eax,eax 00401030 mov cl,byte ptr string "AAAABBBBCCCCDDD" (402104h)[eax] 00401036 mov byte ptr [esp+eax],cl 00401039 add eax,1 0040103C test cl,cl 0040103E jne stack_func+10h (401030h) print_mem((unsigned char*)&buffer+buffer_size+buffer_ret_offset,4); 00401040 lea eax,[esp+18h] 00401044 push 4 00401046 push eax 00401047 call print_mem (4010C0h) buffer[buffer_size+buffer_ret_offset+0] = 'A'; // Pro toto prirazeni za bufffer NEVYGENEROVAL zadny kod! buffer[buffer_size+buffer_ret_offset+1] = 'A'; // Pro toto prirazeni za bufffer NEVYGENEROVAL zadny kod! buffer[buffer_size+buffer_ret_offset+2] = 'A'; // Pro toto prirazeni za bufffer NEVYGENEROVAL zadny kod! buffer[buffer_size+buffer_ret_offset+3] = 'A'; // Pro toto prirazeni za bufffer NEVYGENEROVAL zadny kod! print_mem((unsigned char*)&buffer+buffer_size+buffer_ret_offset,4); 0040104C lea ecx,[esp+20h] 00401050 push 4 00401052 push ecx 00401053 call print_mem (4010C0h) }// Vystup v konzoli - Opet je videt, ze k prepsani NEDOSLO!MEMORY DUMP BEGIN - 0x0012FF80 (4 Bytes)5 (0x35) ? (0x12) @ (0x40) ? (0x00)MEMORY DUMP ENDMEMORY DUMP BEGIN - 0x0012FF80 (4 Bytes)5 (0x35) ? (0x12) @ (0x40) ? (0x00)MEMORY DUMP END// -------------------------------------------------------