Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When buffer overflow/heap overflow is executed, is EIP the one that tells which part will be executed next? Also, when exploiting the part that has buffer overflow vulnerability, after execution, will ESP point to the start of the exploit codes (which will be some combinations of shell codes and gibbersih)?
If this seems too vague, can anyone show me what each register will point to during the execution of exploits?
will ESP point to the start of the exploit codes (which will be some combinations of shell codes and gibbersih)?
Actually, its the EIP that will point to the start of the exploit code instead of ESP. In a classic stack buffer overflow, ESP will continue to be where it would have been with/without exploit code. The only thing that you overwrite is the EIP changing it to a different address in memory - where you've already 'planted' your exploit code somehow.
To illustrate lets see the diagram of a stack and note values of various registers:
Lets assume there is a exploitable buffer in the callee function where an arbitrary amount of data can be provided (gets, rougue srtcpy etc.). The attacker calculates the exact number of bytes before the place on stack where the return address (EIP) is stored. So the input could be of form (each block corresponding to each red line below).
AAAAAAAA AAAAAAAA AAAAAAAA AAAAAAAA AAAAAAAA 0834FD4C
where 0834FD4C is the new instruction pointer attacker wants to plant at the saved EIP location and preceding A's are just pads to reach to the EIP (remember stack grows down).
After the overflow, lets say the stack looks like this:
At this point, attacker has successfully planted the new EIP. Whenever the callee function returns, the ret instruction will pop the saved EIP (now 0x0834FD4C) to %eip register and the control flow will resume from this memory address and will start executing whatever instructions it finds there. Again, the attacker has to make sure that he has planted the exploit code at this location beforehand.
Post callee return:
EBP : Can change or cannot change based on what attacker provides in the data of overflown buffer. Remember that since he has to tromp EBP before he reaches EIP, certainly he'll have to provide a value for EBP as well. Generally the attacker will be diligent enough to enumerate the stack to determine the current EBP and plant it into the payload so that it remains the same as before. For eg. he could(and should) provide something like:
AAAAAAAA AAAAAAAA AAAAAAAA AAAAAAAA 082376ED 0834FD4C
Where 082376ED is the existing EBP. This will make sure that it is not changed to an arbitrary value in the mission to overwrite the EIP.
EIP : It is changed to the new value
ESP : It will revert back to the same value irrespective of buffer overrun or not.
So after the function returns, you'll live in the stack frame of the old caller but will be executing some other code.
