I read some slides from the Black Hat USA 2012 conference, and I stumbled across the term non-­linear/backward overwrite, mentioned on slide 5 of the Exploit Mitigation Improvements in Windows 8 by Ken Johnson and Matt Miller, Microsoft Security Engineering Center (MSEC) (PDF) presentation:

            History of exploit mitigations on Windows             Image attribution: Ken Johnson, Matt Miller, Microsoft Security Engineering Center (MSEC)

According to this image, in Windows 7 there is no mitigation for this kind of overwrite, yet.

Has anyone a clue what this non-­linear/backward overwrite is, and can give me some additional information about this exploitation technique?


First of all, a "linear overwrite" is the most common type of buffer overflow. This is the example given in the slide. Where by starting at some base address you write in a linear fashion and eventually you overwrite the return address:

void function(LPCSTR input){
    char buffer[256];
    strcpy(buffer, input);

An example of a non-linear overwrite is this GroupWise ActiveX control exploit written by rGod. This ActiveX component has a method call where one of the parameters is a memory address, which allows an attacker to write to an arbitrary location in memory. If the return address was protected by a canary the attacker could just point directly to the return address and overwrite it without corrupting the canary. Dangling pointers can also produce a condition where by the attacker can control a specific address in which to read, write, or execute in a non-linear fashion.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.