Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When buffer overflow/heap overflow is executed, is EIP the one that tells which part will be executed next? Also, when exploiting the part that has buffer overflow vulnerability, after execution, will ESP point to the start of the exploit codes (which will be some combinations of shell codes and gibbersih)?

If this seems too vague, can anyone show me what each register will point to during the execution of exploits?

share|improve this question
add comment

1 Answer

will ESP point to the start of the exploit codes (which will be some combinations of shell codes and gibbersih)?

Actually, its the EIP that will point to the start of the exploit code instead of ESP. In a classic stack buffer overflow, ESP will continue to be where it would have been with/without exploit code. The only thing that you overwrite is the EIP changing it to a different address in memory - where you've already 'planted' your exploit code somehow.

To illustrate lets see the diagram of a stack and note values of various registers:

A normal stack frame depicting a caller and a callee

Lets assume there is a exploitable buffer in the callee function where an arbitrary amount of data can be provided (gets, rougue srtcpy etc.). The attacker calculates the exact number of bytes before the place on stack where the return address (EIP) is stored. So the input could be of form (each block corresponding to each red line below).

AAAAAAAA AAAAAAAA AAAAAAAA AAAAAAAA AAAAAAAA 0834FD4C

where 0834FD4C is the new instruction pointer attacker wants to plant at the saved EIP location and preceding A's are just pads to reach to the EIP (remember stack grows down).

After the overflow, lets say the stack looks like this: A stack depicting a buffer overflow with EIP being overwritten

At this point, attacker has successfully planted the new EIP. Whenever the callee function returns, the ret instruction will pop the saved EIP (now 0x0834FD4C) to %eip register and the control flow will resume from this memory address and will start executing whatever instructions it finds there. Again, the attacker has to make sure that he has planted the exploit code at this location beforehand.

Post callee return:
EBP : Can change or cannot change based on what attacker provides in the data of overflown buffer. Remember that since he has to tromp EBP before he reaches EIP, certainly he'll have to provide a value for EBP as well. Generally the attacker will be diligent enough to enumerate the stack to determine the current EBP and plant it into the payload so that it remains the same as before. For eg. he could(and should) provide something like:

AAAAAAAA AAAAAAAA AAAAAAAA AAAAAAAA 082376ED 0834FD4C

Where 082376ED is the existing EBP. This will make sure that it is not changed to an arbitrary value in the mission to overwrite the EIP.

EIP : It is changed to the new value

ESP : It will revert back to the same value irrespective of buffer overrun or not.

So after the function returns, you'll live in the stack frame of the old caller but will be executing some other code.


Smashing the Stack for Fun and Profit is an excellent source for any further information.

share|improve this answer
1  
I look at a question and say 'eh, can't write all that'. Come back again in a hour and say 'eh, let me write a quick 1 liner'... an hour later its no longer a 'one liner'. I am sure SE does this to so many people every day :| –  Shivam Jul 11 '12 at 17:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.