To: randy.bryant@cs.cmu.edu

Sent: Saturday, June 25, 2005 9:24 AM

Subject: A question about one of CS:APP's homework

Hello Prof. Bryant,

I got a problem when I was reading Chapter 3 of CS:APP. That is homework 3.38. The description is as followed(copied from the book).

Homework Problem 3.38 [Category 3]:

In this problem, you will mount a buffer overflow attack on your own program. As stated earlier, we do not condone using this or any other form of attack to gain unauthorized access to a system, but by doing this exercise, you will learn a lot about machine-level programming...

To solve this problem, I think the only way is to overwrite the return address of function getbuf(), make it point to a specified address where some executive codes is set from the input. I run the program under GDB. When I do this, I received a segmentation fault. Maybe the operation system prevents program running from the data segment or program stack. I wonder is there any other way to change the process of a program? What is the exact inputing string to make getbuf() return 559038737(0xdeadbeef) to test()?

If you're too busy to reply, just give me the answer.

Linux Kernel is version 2.6.9-1.667, gcc version 3.4.2, gdb version 6.1

Thanks a lot. Your help is very essential to my understanding of this book.

Sonny

Jun 26, 2005

From :  Randy Bryant <Randy.Bryant@cs.cmu.edu>

Sent :  Monday, June 27, 2005 10:08 PM

Subject :  RE: A question about one of CS:APP's homework

You'll notice that this problem is rated as a difficult problem. That's partly because it's hard to determine why a particular solution doesn't work. To solve this problem, you need to have an exploit string that:

1. Overwrites the return address to be that of your exploit code

2. Write exploit code that alters the return value, corrects the return address, and re-executes the return

3. Sets the saved value of %ebp to its original value.

If you do any of these steps wrong, you'll get a segmentation fault. You can used GDB to help you step through the code, but even this is difficult.

That said, it is possible that your Linux system has mechanisms that make the assignment much more difficult. Some versions of Linux 2.6 contain a technology called "ExecShield". This does the following:

* Make it so that code on the stack is not executable

* Use randomization, so that the stack locations change with each execution.

You can test whether your version is using randomization by running a program under GDB multiple times. Set a breakpoint in main, and each time check the value of %ebp. If it changes every time, then your OS is using randomization.

You can disable Execshield at the time you boot your system.