memcpy 溢出
当我控制了 src 和 length 参数时，是否可以在以下情况下覆盖 eip？
memcpy(float* dest,float* src, int length)
我想应该可以覆盖 eip(?) 但是否可以用有意义的东西覆盖它？
**抱歉没说清楚。我所说的覆盖EIP，是指覆盖函数返回后EIP寄存器将使用的返回指针，从而转移程序执行。
Is it possible to overwrite the eip in the following condition when I have control over the src and the length parameters?
memcpy(float* dest,float* src, int length)
I guess it should be possible to overwrite the eip(?) but is it possible to overwrite it with something meaningful?
**Sorry for not being clear. By overwriting EIP, I mean overwriting the return pointer which would be used by the EIP register after the function returns, transferring the program execution.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
由于 eip 是一个寄存器，因此您无法覆盖它。您只能覆盖堆栈上的值。缓冲区溢出攻击涉及覆盖函数的返回值，从而将执行传递给可以解释为您放置在内存中某处的代码的数据。
针对您的澄清：
是的。由于调用函数时返回指针被压入堆栈，因此您可以写入此内存位置。它位于任何变量分配之上（假设 x86 架构和默认调用约定）。您可以在此处编写一个指向下一个内存位置的值，您应该在其中加载与已处理的汇编语言指令相对应的二进制数据。请注意，按照我所描述的操作，您已经破坏了堆栈以及程序在注入代码后继续执行的任何机会。为此，您必须将返回地址保存在堆栈上的其他位置，并编写一个 shellcode 将其复制到正确的位置，然后执行返回。
我还假设 dest 参数是可控的。如果你不能把数据放在你想要的地方，它对你来说就没用
Since eip is a register, you cannot overwrite it. You can only overwrite values on the stack. A buffer overflow attack involves overwriting the return value of a function, thereby passing execution to data that can be interpreted as code which you have placed somewhere in memory.
In response to your clarification:
Yes. Since the return pointer is pushed on the stack when a function is called, you can write to this memory location. It will be found just above any allocations for variables (assuming the x86 architecture and the default calling convention). You can write a value here pointing to the very next memory location, where you should load binary data corresponding to processed assembly language instructions. Note that by doing as I have described, you have destroyed the stack and any chance of the program continuing to execute after your injected code. To do that, you must save the return address somewhere else on the stack and write a shellcode that copies it to the correct location, then executes a return.
I also assume that the dest parameter is controllable. If you can't place the data where you want it, it's useless to you
如果您所说的“eip”指的是 x86 的扩展指令指针，那么不，不是直接的（如果您有类似于“memcpy”的有效实现的任何内容）。这是因为 x86 的寄存器不是内存映射的。您可以通过覆盖调用 memcpy 时压入堆栈的返回值来间接完成此操作。然后，当 memcpy 返回时，它会将这个错误值弹出到 eip 中，并尝试从不知道在哪里继续执行。
至于用有意义的东西覆盖它，这取决于你所说的“有意义”是什么意思。如果您的意思是“不会立即使程序崩溃（从操作系统的角度来看）的东西”，那么是的。如果您假设您用随机数据完全覆盖它，那么统计上您有如此多的页面以可执行的方式映射到您的程序中，以及如此多可能的内存页面，并且可以计算您跳转到可执行文件的概率页。然后，您就很难计算出可以执行很长时间而不会崩溃的概率（这实际上是经典的停止问题的一种形式）。
If by
eipyou mean x86's Extended Instruction Pointer, then no, not directly (if you have anything resembling a valid implementation ofmemcpy). This is because x86's registers are not memory mapped. You can do it indirectly by overwriting the return value that was pushed onto the stack when memcpy was called. Then when memcpy returns it would pop this bad value intoeipand try to continue executing from who knows where.As far as overwriting it with something meaningful, that depends on what you mean by "meaningful". If you mean "something that won't make the program crash (from the OS's point of view) immediately" then yes. If you assume that you overwrite it entirely with random data then statistically you have so many pages mapped into your program in a way that they are executable, and so many possible pages of memory, and can calculate a probability that the you jump to a executable page. Then you have a harder time calculating the probability that what is there can execute for very long without crashing (this is actually a form of the classic halting problem ).
“覆盖 eip”是什么意思？
EIP是寄存器，不是内存。它不会被覆盖。
memcpy 可能会覆盖 EIP 指向的内存中的指令流。但代码页通常与数据/堆栈/堆页不太接近，并且通常也是只读的。
更常见的是堆或堆栈上的数据被覆盖，后续指令将其用作加载到 EIP 中的地址 - 例如，如果函数指针被覆盖并用作回调，或者返回地址被覆盖并跳到.
（在您的示例中，您说过
src和length受到控制，但是dest呢？）What do you mena by "overwrite eip"?
EIP is a register, not memory. It will not be overwritten.
It may be possible for the memcpy to overwrite the instruction stream in memory pointed to by EIP. But code pages are usually not too close to data/stack/heap pages, and are often read-only too.
What is more common is that data on the heap or stack is overwritten, which subsequent instructions use as an address to load into EIP — for example, if a function pointer is overwritten and used as a callback, or if the return address is overwritten and jumped to.
(In your example, you've said that
srcandlengthare controlled, but what aboutdest?)