修改栈返回地址-改变程序执行流程.docx

修改栈中函数调用返回地址，改变程序执行流程任务：修改栈中函数调用返回地址，改变程序执行流程在本例中，通过修改函数function调用返回地址，使程序跳过执行x=1的赋值语句，从而使输出结果为0为了实现这个目标，需要1.找到函数调用返回地址在栈中的位置 由于c程序中无法直接取得返回地址，本例中以buffer1地址为基址，通过计算其与返回地址在栈中地址的差值，得到返回地址（在栈中）的地址 对应程序中的7、8句 7 ret=buffer1+12; 8 (*ret)+=5;buffer1和返回地址通过gdb调试得到2 .计算所跳过指令与下一条指令的差值，这通过反汇编代码可以直接计算得出源程序 1 i#include 2 void function(int a,int b,int c) 3 4 char buffer15; 5 char buffer210; 6 int *ret; 7 ret=buffer1+12; 8 (*ret)+=5; 9 10 11 void main() 12 13 int x; 14 x=0; 15 function(1,2,3); 16 x=1; 17 printf(%dn,x); 18 编译：gcc -o e -g e.c调试：gdb e 反汇编 disassemble main 0x0804844e :push %ebp 0x0804844f :mov %esp,%ebp 0x08048451 :and $0xfffffff0,%esp 0x08048454 :sub $0x20,%esp 要跳过指令地址 0x08048457 :movl $0x0,0x1c(%esp) 0x0804845f :movl $0x3,0x8(%esp) 0x08048467 :movl $0x2,0x4(%esp) 0x0804846f :movl $0x1,(%esp) 0x08048476 :call 0x8048414 0x0804847b :movl $0x1,0x1c(%esp) 0x08048483 :mov $0x8048560,%eax 0x08048488 :mov 0x1c(%esp),%edx 0x0804848c :mov %edx,0x4(%esp) 0x08048490 :mov %eax,(%esp) 0x08048493 :call 0x8048338 0x08048498 :leave 0x08048499 :ret disassemble function: 0x08048414 :push %ebpBuffer1地址 ！ 0x08048415 :mov %esp,%ebp 0x08048417 :sub $0x28,%esp 0x0804841a :mov %gs:0x14,%eax 0x08048420 :mov %eax,-0xc(%ebp) 0x08048423 :xor %eax,%eax 0x08048425 :lea -0x21(%ebp),%eax 0x08048428 :add $0xc,%eax 0x0804842b :mov %eax,-0x1c(%ebp) 0x0804842e :mov -0x1c(%ebp),%eax 0x08048431 :mov (%eax),%eax 0x08048433 :lea 0x5(%eax),%edx 0x08048436 :mov -0x1c(%ebp),%eax 0x08048439 :mov %edx,(%eax) 0x0804843b :mov -0xc(%ebp),%eax 0x0804843e :xor %gs:0x14,%eax 0x08048445 :je 0x804844c 0x08048447 :call 0x8048348 0x0804844c :leave 0x0804844d :ret下面通过设置断点和单步调试的方法找到所需地址在x=0处设置断点 break 14运行 run寄存器情况：(gdb) info registerseax 0xbffff3e4-1073744924ecx 0x133a3a60322583136edx 0x11ebx 0x287ff42654196esp 0xbffff3100xbffff310ebp 0xbffff3380xbffff338esi 0x00edi 0x00eip 0x80484570x8048457 eflags 0x282 SF IF cs 0x73115ss 0x7b123ebpds 0x7b123es 0x7b123fs 0x00gs 0x3351栈的情况：0xbffff310:0x002883240x00287ff40x080484b00xbffff3380xbffff320:0x0015e9850x0011eb800x080484bb0x00287ff40xbffff330:0x080484b00x00000000下一条指令 (gdb) display/i $pc = 0x8048457 :movl $0x0,0x1c(%esp)继续执行(gdb) si15function(1,2,3);1: x/i $pc= 0x804845f :movl $0x3,0x8(%esp)看寄存器(gdb) info registerseax 0xbffff3e4-1073744924ecx 0x133a3a60322583136edx 0x11ebx 0x287ff42654196esp 0xbffff3100xbffff310ebp 0xbffff3380xbffff338esi 0x00edi 0x00eip 0x804845f0x804845f eflags 0x282 SF IF cs 0x73115ss 0x7b123ds 0x7b123es 0x7b123fs 0x00gs 0x3351栈(gdb) x/10x $esp0xbffff310:0x002883240x00287ff40x080484b00xbffff3380xbffff320:0x0015e9850x0011eb800x080484bb0x00000000X地址在这0xbffff330:0x080484b00x00000000继续执行下一条指令(gdb) si0x0804846715function(1,2,3);1: x/i $pc= 0x8048467 :movl $0x2,0x4(%esp)寄存器(gdb) info registerseax 0xbffff3e4-1073744924ecx 0x133a3a60322583136edx 0x11ebx 0x287ff42654196esp 0xbffff3100xbffff310ebp 0xbffff3380xbffff338esi 0x00edi 0x00eip 0x80484670x8048467 eflags 0x282 SF IF cs 0x73115ss 0x7b123ds 0x7b123es 0x7b123fs 0x00gs 0x3351栈(gdb) x/10x $esp0xbffff310:0x002883240x00287ff40x000000030xbffff3380xbffff320:0x0015e9850x0011eb800x080484bb0x000000000xbffff330:0x080484b00x00000000继续下一条指令(gdb) si0x0804846f15function(1,2,3);1: x/i $pc= 0x804846f :movl $0x1,(%esp)寄存器(gdb) info registerseax 0xbffff3e4-1073744924ecx 0x133a3a60322583136edx 0x11ebx 0x287ff42654196esp 0xbffff3100xbffff310ebp 0xbffff3380xbffff338esi 0x00edi 0x00eip 0x804846f0x804846f eflags 0x282 SF IF cs 0x73115ss 0x7b123ds 0x7b123es 0x7b123fs 0x00gs 0x3351栈：(gdb) x/10x $esp0xbffff310:0x002883240x000000020x000000030xbffff3380xbffff320:0x0015e9850x0011eb800x080484bb0x000000000xbffff330:0x080484b00x00000000继续下一条指令(gdb) si0x0804847615function(1,2,3);1: x/i $pc= 0x8048476 :call 0x8048414 寄存器(gdb) info registerseax 0xbffff3e4-1073744924ecx 0x133a3a60322583136edx 0x11ebx 0x287ff42654196esp 0xbffff3100xbffff310ebp 0xbffff3380xbffff338esi 0x00edi 0x00eip 0x80484760x8048476 eflags 0x282 SF IF cs 0x73115ss 0x7b123ds 0x7b123es 0x7b123fs 0x00gs 0x3351栈（参数1被压入栈）(gdb) x/10x $esp0xbffff310:0x000000010x000000020x000000030xbffff3380xbffff320:0x0015e9850x0011eb800x080484bb0x000000000xbffff330:0x080484b00x00000000开始调用函数function(gdb) sifunction (a=1, b=2, c=3) at e.c:331: x/i $pc= 0x8048414 :push %ebp寄存器：（esp值减小了4）(gdb) info registerseax 0xbffff3e4-1073744924ecx 0x133a3a60322583136edx 0x11ebx 0x287ff42654196esp 0xbffff30c0xbffff30cebp 0xbffff3380xbffff338esi 0x00edi 0x00eip 0x80484140x8048414 eflags 0x282 SF IF cs 0x73115ss 0x7b123ds 0x7b123es 0x7b123返回地址 ！fs 0x00gs 0x3351栈：（返回地址被压入栈）(gdb) x/10x $esp0xbffff30c:0x0804847b0x000000010x000000020x000000030xbffff31c:0xbffff3380x0015e9850x0011eb800x080484bb0xbffff32c:0x000000000x080484b0通过查看栈中内容，我们发现，0x0804847b原来是call返回后下一条指令的地址：0x0804847b :movl $0x1,0x1c(%esp)我们要修正的正是这个地址，其位于0xbffff30c处执行下一条指令 （push %ebp）(gdb) si0x0804841531: x/i $pc= 0x8048415 :mov %esp,%ebp寄存器：(gdb) info registerseax 0xbffff3e4-1073744924ecx 0x133a3a60322583136edx 0x11ebx 0x287ff42654196esp 0xbffff3080xbffff308ebp 0xbffff3380xbffff338esi 0x00edi 0x00eip 0x80484150x8048415 eflags 0x282 SF IF cs 0x73115ss 0x7b123ds 0x7b123es 0x7b123fs 0x00gs 0x3351栈（ebp的值入栈）(gdb) x/10x $esp 0xbffff308:0xbffff3380x0804847b0x000000010x000000020xbffff318:0x000000030xbffff3380x0015e9850x0011eb800xbffff328:0x080484bb0x00000000执行下一条指令：mov %esp,%ebp(gdb) si0x0804841731: x/i $pc= 0x8048417 :sub $0x28,%esp寄存器（ebp被esp赋值）(gdb) info registerseax 0xbffff3e4-1073744924ecx 0x133a3a60322583136edx 0x11ebx 0x287ff42654196esp 0xbffff3080xbffff308ebp 0xbffff3080xbffff308esi 0x00edi 0x00eip 0x80484170x8048417 eflags 0x282 SF IF cs 0x73115ss 0x7b123ds 0x7b123es 0x7b123fs 0x00gs 0x3351栈0xbffff308:0xbffff3380x0804847b0x000000010x000000020xbffff318:0x000000030xbffff3380x0015e9850x0011eb800xbffff328:0x080484bb0x00000000执行下一条指令（sub $0x28,%esp）(gdb) si31: x/i $pc= 0x804841a :mov %gs:0x14,%eax寄存器(gdb) info registerseax 0xbffff3e4-1073744924ecx 0x133a3a60322583136edx 0x11ebx 0x287ff42654196esp 0xbffff2e00xbffff2e0ebp 0xbffff3080xbffff308esi 0x00edi 0x00eip 0x804841a0x804841a eflags 0x282 SF IF cs 0x73115ss 0x7b123ds 0x7b123es 0x7b123fs 0x00gs 0x3351栈(gdb) x/10x $esp0xbffff2e0:0x00237e490x0015e7850xbffff2f8 0x00145ae50xbffff2f0:0x000000000x08049ff40xbffff3080x080483040xbffff300:0x0011eb800x08049ff4执行下一条指令：mov %gs:0x14,%eax(gdb) si0x0804842031: x/i $pc= 0x8048420 :mov %eax,-0xc(%ebp)寄存器：(gdb) info registerseax 0x3f8efa001066334720ecx 0x133a3a60322583136edx 0x11ebx 0x287ff42654196esp 0xbffff2e00xbffff2e0ebp 0xbffff3080xbffff308esi 0x00edi 0x00eip 0x80484200x8048420 eflags 0x282 SF IF cs 0x73115ss 0x7b123ds 0x7b123es 0x7b123fs 0x00gs 0x3351执行下一条指令：mov %eax,-0xc(%ebp)(gdb) si0x0804842331: x/i $pc= 0x8048423 :xor %eax,%eax寄存器：(gdb) info registerseax 0x3f8efa001066334720ecx 0x133a3a60322583136edx 0x11ebx 0x287ff42654196esp 0xbffff2e00xbffff2e0ebp 0xbffff3080xbffff308esi 0x00edi 0x00eip 0x80484230x8048423 eflags 0x282 SF IF cs 0x73115ss 0x7b123ds 0x7b123es 0x7b123fs 0x00gs 0x3351栈：(gdb) x/10x $esp0xbffff2e0:0x00237e490x0015e7850xbffff2f8 0x00145ae50xbffff2f0:0x000000000x08049ff40xbffff3080x3f8efa000xbffff300:0x0011eb800x08049ff4执行xor %eax,%eax(gdb) si7ret=buffer1+12;1: x/i $pc= 0x8048425 :lea -0x21(%ebp),%eax寄存器：(gdb) info registerseax 0x00ecx 0x4a6d85dc1248691676edx 0x11ebx 0x287ff42654196esp 0xbffff2e00xbffff2e0ebp 0xbffff3080xbffff308esi 0x00edi 0x00eip 0x80484250x8048425 eflags 0x246 PF ZF IF cs 0x73115ss 0x7b123ds 0x7b123es 0x7b123fs 0x00gs 0x3351栈：(gdb) x/10x $esp0xbffff2e0