堆栈缓冲区溢出如何用包含空字符的值覆盖局部变量
我试图找出一种方法来覆盖包含此代码的函数的返回地址：
长度=大于目标大小但小于目标数组开头的返回地址偏移量。
for (i = 0; i <= length; i++)
target[i] = argument[i];
参数是我从输入中传入的内容。
局部变量 length 足够大，我可以溢出参数来覆盖 i 和 length。
假设返回地址相对于目标起始地址的偏移量为 300。
我需要将 i 覆盖为小于 300 (0x12c) 的某个数字，并将 length 覆盖为大于某个数字超过 300。
由于这是 32 位系统，0x0000012c 整数包含空字符，因此我无法通过参数传递它。
在这种情况下有没有办法覆盖返回地址？
I am trying to figure out a way to overwrite return address of a function containing this code:
length = bigger than target size but smaller than return address offset from beginning of target array.
for (i = 0; i <= length; i++)
target[i] = argument[i];
Argument is what I pass in from input.
Local variable, length, is big enough that I can overflow argument to overwrite i and length.
Let's assume offset of return address from start address of target is 300.
I need to overwrite i to be some number smaller than 300 (0x12c) and length to be some number larger than 300.
Since this is 32-bit system, 0x0000012c integer contains null character so I cant pass it in through the argument.
Is there a way to overwrite return address in this case?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
听起来像是缓冲区溢出挑战。
在大多数情况下，您不能写入空字节，例如缓冲区溢出是由 strcpy() 等不安全字符串函数之一引起的。在这种情况下，您正在使用 for 循环移动字节，因此如果您可以影响长度值（该值可能在堆栈上...），则可能会复制空字节。
另一种可能性是查看数据类型。如果它有符号，那么非常大的值将被解释为负数。复习一下“算术溢出”，尽管在这次攻击中您将覆盖一个数值。
Sounds like a buffer overflow challenge.
Your right in most cases you cannot write a null byte, such as if the buffer overflow is caused by one of the unsafe string functions like strcpy(). In this case you are moving bytes with a for loop, so if you can influence the length value (this value is probably on the stack...) then it maybe possible to copy null bytes.
Another possibility is looking at the data type. If it is signed, then very large values would be interpreted as a negative number. Brush up on "arithmetic overflows", although in this attack you are overwriting a numeric value.