Exploit Development (part 2) A Program in Memory
Video Activity
This lesson covers the general service registers: EIP: instruction pointer ESP: Base pointer ESI: Source Index EDI: Destination Index EAX: Accumulator EBX: Base ECX: Counter EDX: Data General Service Registers help programmers keep track of where they are in the memory stack frame. This lesson also covers calling another function.
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or
Already have an account? Sign In »
Video Description
This lesson covers the general service registers:
-
EIP: instruction pointer
-
ESP: Base pointer
-
ESI: Source Index
-
EDI: Destination Index
-
EAX: Accumulator
-
EBX: Base
-
ECX: Counter
-
EDX: Data
General Service Registers help programmers keep track of where they are in the memory stack frame. This lesson also covers calling another function.
Video Transcription
00:04
you may have noticed that typically in this class, I've just left the slides for you for reference. We haven't really looked at them too much, but in this case, when you exploit development, there is a little bit of background I need to give you from the flies. Have plenty more slides for the section other than the ones we're going to look at.
00:21
So by all means do you take a look at them for your reference? And she worked through it.
00:25
Those take a look at a few little reference lives before we begin the hands on portion of exploit development
00:32
here on the 1st 1 We do have a somewhat dumbed down version of what a program looks like in memory.
00:40
You're familiar with this already? You'll notice some of the sections actually, aren't there like there's a B s s section for non initialized data that's not shown here in the pictures. That is not a complete picture. But what we're interested in, particularly is the stack. That's where we're going to be doing our
01:00
actually development. We're going to stick to stack based buffer overflows.
01:04
There are certainly other kinds of memory corruption exploits but we're just going to look at the basics of stack ways, but for overflows. So we are particularly interested in the section here stack
01:17
Modus. That stack starts at high memory and grows towards lower memory so you can think about it. It was kind of upside down, and if you forget that when we actually look at memory will be reminded of that. But
01:33
hi, I'm Emory. To low memory
01:34
is the stack.
01:37
Also, we need to know a little bit about our registers. You think of registers is just a place to store data in the sea for you, for us to use it on. The registers are going to depend on your platform here working with mobile phones and you have an arm chip you're registered will be a bit different than what we see here.
01:57
These are X 86
01:59
register, So he i p e s p e v p So on and so forth. E e is for extended basically took me
02:07
16 bit registers and put me on the front of them and made them extended for a 32 bit.
02:13
And we actually really only have two for this section.
02:17
No the 1st 3 e i p E S, P and E v p. We will see an exercise that uses S I
02:25
on dhe. If you continue an exploit development, you'll certainly end up using the others. But our most important ones are E I P S P and E V P v. I. P is our sort of holy grail for exploit development. The i p the extended instruction pointer.
02:42
It holds the memory address of the next instruction to be executed by the CPU.
02:46
If our goal is to take control of the CPU and make it execute code on our behalf, having control of the I p. Seems like exactly what we should be after that. Indeed it is.
02:58
ESPN e v v extended stack pointer and extended base pointer. Those are the top and the bottom of the stack, respectively. S P pointing to the currents, back frames,
03:12
top or Louis memory address. Remember, the stack is basically upside down an EVP. The base is the bottom
03:19
with highest memory address. So keeps track of where we are in the stack in memory, where stack frame is
03:25
again, there will be an exercise uses e sa
03:30
and you know, we'll see the other ones those We look at memory and look at what's in the registers. But really the only three that are very important to us. And we need to know what they do are the top three E I. P S P and E V p.
03:46
So the stack give This is the one that we are looking at here. We're going to do stack baseball for overflows.
03:53
So it is a last in first out. Or I guess, if we were going to get technical with computer science, Jared and I believe they say
04:00
first in last out or
04:03
last in first out. I'm not sure whichever you think of it both ways,
04:10
but you can just think of it as a stack of one. Strange in the last one that is put on by a cafeteria worker that's clean is the 1st 1 that is picked up by a patron. You have to kind of jumble things around if you want to do it any other way and same way with the stack. If you want to take something off a stack, you only have one choice. It being
04:30
the thing is currently on the top
04:31
and likewise, if you want to put something on to the stack, you have to put it on at the top. You can't dis insert it wherever you feel like. Certainly there are ways of addressing other parts of memory. But using the push and pop instructions,
04:46
push, Push is something onto the stack onto the top and pop pops off the top of Saxon again. I like the analogy of the one strays, but whatever
04:58
makes you understand it well,
05:00
all right, here is an example of a stack frame of memory. You BP is kind of like, written up a little bit here. It should be down in the bottom. Really? Sure how that happened.
05:12
But again, hi. Memory at the bottom. Blue memory at the top.
05:15
And, yes, Piot the top E V V at the bottom.
05:19
But when things really get interesting
05:21
is when we call another function. Typically, when you work with a program, it is going to have more than one function. Would you proper programming? We should definitely use lots of functions. We shouldn't just open May Unversity program and then just write everything we're gonna do in there
05:40
But even if we do, chances are we're going to call some built in function of some kind, like to make it print to the screen. For instance, we would call Something is built into sees that we would be calling another function. Even if we don't make a second function ourselves, it would be fairly difficult to do anything useful without
05:59
calling some function of some kind.
06:01
So chances are we're going to have our man function call another function. At some point when that function finishes, it may even call other ones. So you end up with lots of functions called. But when our function finishes, it needs to return back to Maine.
06:17
So we need some way of keeping track of
06:21
where it should return to. It shouldn't just start at the beginning of Maine again. It needs to pick up where it left off. So we need Thio store that somewhere, and that is the meat of what we're going to be doing is we're going to take that saved the return address, and we're going to manipulate it.
06:41
So how this works the next 86 they're gonna it varies like arm does it a little bit differently that ultimate logically, it comes out about the same, but there's really no like that way You have to do this. But for our X 86. How this is done is when another function is called
07:00
before the stack frame for the new function is pushed onto the stack. Well, it's wound onto the stack. It's a little bit different than just push, push, push, push. We can actually look at the assembly for that. It's basically it adds, or rather subtract, because we want to move to lower memory E S p
07:18
to make some new space. We'll see that
07:21
getting a little ahead of myself. But anyways, before we do that, we actually saved the return address. So we take the next instruction to be executed in Maine, are currently executing function and push it onto the stack. So we just say what? They're right on top of me in stock frame
07:38
on. Then we create a stack frame for our new function on top of that
07:43
on, then, when the function finishes, its stack frame pops off
07:47
and or is unwound again. It's not this pop pop, pop pop
07:53
popping off data, so a little bit more complicated, will see that we look at the assembly,
07:59
but then we get rid of that stack frame ESPN e v P. That will need to move back into May and stack frame
08:05
from the function. And we take that safe return address That's right on top of main Stack frame and we load in T i p So it returns as though we never left main at all. We just pick up right where we left off.
08:22
So here's a
08:24
the little example here of what it looks like in memory. So we have main stack frame again. We have that return address. So that is the memory address to return to in Mainz and next instruction we want to execute when our function finishes. This case I've called our function function one
08:41
and we have e S P wall function. One is executing SP will be at the lowest memory, duress or top
08:48
of function one stack frame you see again, yeah, looks like it's going up a little bit, but it is pointing at the bottom of the current stack frame, and it also has in this case, the saved E v P. from Maine that we basically at the bottom of function one stack frame have are shaved E v p.
09:07
What will happen when it finishes?
09:09
We'll bring SP back down E E v p.
09:13
We'll get the save TV fee for main movie V P there
09:18
on. Then the victory will pop that off into the VP to restore e v p o E s p. Since we pop this off will now be pointing here of the hour return address will return to it so low that indie i p to whatever is here which should be our safe return address in Maine.
09:37
Since we're doing exploit development, I can imagine we might want to put
09:39
something else there, get control of the I P. That is in fact, exactly what we're gonna do in a section.
09:46
And then if we pop that off, then E s P will now be pointing back at the top of Maine. We will restored ESPN ABP again that we can see that with the assembly if we look at our assembly instructions. If you're not familiar with assembly, don't worry. No requirement for that. We're not really going to do too terribly much assembly
10:07
in this class
10:09
a little bit we need in order to work through this with us. Just a general idea of how this works. So again, just a little bit of theory here. Just remember our register Z i p e s p and e v p and kind of get an idea of what this looks like. You actually look at a program. We'll see
10:28
how this works will see that it actually does follow the theory, which is nice.
10:31
So with that, let's stop playing with slides, and I'm sure you didn't look at it.
Up Next
Similar Content
