Buffer overflow attacks bypassing DEP (NX/XD bits) - part 1 : Simple Call

Premise

All you read here (and its sequel posts) is just a concrete implementation of many proposed ways to exploit buffer overflows to execute arbitrary code; in particular this post will focus on bypassing the DEP (Data Execution Prevention) which uses the NX bit on AMD chips and XD bit on Intel chips to prevent code execution from data segments (NX and XD are, as far as I know, the same bit with two different names so that Intel’s pride was satisfied - just like amd64 techology is also called x86-64, x64, aa64 and em64t - wasn’t a name enough ? :|) .

The DEP is really a needed feature which was incredibly missing from x86 (ia32 ;)) processors. It is a good protection which effectively makes harder to write exploits for unchecked buffers bugs. However it doesn’t make them impossible - it just makes them slightly harder to do.

If this post (and its sequels) strikes you down in fear, then remember to update all your applications to the latest versions and check them consistently for bugfixes repairing buffer overflows, and if you are a programmer, triple check your code to look for these bugs.

Please, note also that nothing in these posts is an original idea, since these methods are discussed in theory in many sites around the internet. What was missing was a proof of concept of those exploits, which you can find here.

Read more

June 4, 2005 | Filed Under Programming, Security, Uncategorized, x86/64 (amd64) specific, x86/ia32 specific | 1 Comment 

← Previous Page