Analysis of McAfee's "buffer overflow protection" and bypass methods [anxio Leven]

[McAfee's "buffer overflow protection"]
If the shellcode in the stack calls functions such as getprocaddress, McAfee terminates the current process and generates an alarm.

[Analysis principle]
McAfee intercepts API functions such as loadlibrarya, loadlibraryw, and getprocaddress for all processes. The method is similar to API Interception: change the first several bytes of these functions to call detectapiret, that is, call entapi. detectapiret in DLL. This function checks whether the parent function that calls functions such as getprocaddress is in the heap or stack. If yes, it generates an alarm and exits the current process; otherwise, return to functions such as getprocaddress.

[Bypass Method]
Detectapiret simply regards the value of [esp + 0x04] As the return address of the parent function, so you only need to treat it as a valid return address, then forge a function call environment.
For example, if we want to call getprocaddress in shellcode and call detectapiret, the normal Stack is like this.

------------
0x0013aaaa // return address
Parameter 1
Parameter 2
------------

Construct such an environment

------------
0x7c9231db // the address in Ntdll. dll. The content is 0xc3 (RET)
Parameter 1
Parameter 2
0x0013aaaa // the actual return address
------------

Therefore, when shellcode calls getprocaddress, it first pushes 0x0013aaaa, then pushes two parameters, finally pushes 0x7c9231db, and then JMP getprocaddress.
Here, 0x0013aaaa needs to be obtained by calculating the relative offset address.