Shulou(Shulou.com)06/01 Report--

Video of this article:

If the text is too boring, watch the online video: https://edu.51cto.com/sd/16514

Basics:

We know that in the 32-bit operating system, it mainly overflows the stack buffer and overrides the return address of the function to reach the wood of the hijacking program, so Linux uses canary to protect the return address of the function in order to prevent this problem.

Canary protection is one of the many protection mechanisms of Linux, and its main function is to prevent overflow. Its working principle is that when the function is executed, take the value of gs:0x14 and put it in a certain position, we assume that it is called A, then after the execution of the program, the value of An is different from the value of gs:0x14, or if the result is 0, it has not been modified, otherwise it has been modified.

Let's look at the effect through the code.

First of all, we do not use canary protection: gcc-M32-o0 canary.c-o canary

Use canary protection: gcc-fstack-protector-all-M32-o0 canary.c-o canary

What is marked red in the screenshot is the effect of adding-fstack-protector-all. At the beginning, take the data of gs:0x14 and save it to the location of ebp-exc.

The second red mark is that the data of ebp-0xc location is compared with the value of gs:0x14. If you want to change the value of the returned address of the function, you must first overwrite the value of canary, while the value of canary is random, so if there is no way to get the value of canary, there is no way to overflow.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.