Bug Hunter Diary

This was only a short introduction to the world of buffer overflows.Numerous books and white papers are available on this topic. Ifyou want to learn more, I recommend Jon Erickson’s Hacking: The Artof Exploitation, 2nd edition (No Starch Press, 2008), or you can typebuffer overflows into Google and browse the enormous amount of materialavailable online.A.2 null Pointer DereferencesMemory is divided into pages. Typically, a process, a thread, or thekernel cannot read from or write to a memory location on the zeropage. Listing A-2 shows a simple example of what happens if the zeropage gets referenced due to a programming error.01 #include 0203 typedef struct pkt {04 char * value;05 } pkt_t;0607 int08 main (void)09 {10 pkt_t * packet = NULL;1112 printf ("%s", packet->value);1314 return 0;15 }Listing A-2: Using unowned memory—an example NULL pointer dereferenceIn line 10 of Listing A-2 the data structure packet is initialized withNULL, and in line 12 a structure member gets referenced. Since packetpoints to NULL, this reference can be represented as NULL->value. Thisleads to a classic NULL pointer dereference when the program tries toread a value from memory page zero. If you compile this programunder Microsoft Windows and start it in the Windows DebuggerWinDbg (see Section B.2), you get the following result:[..](1334.12dc): Access violation - code c0000005 (first chance)First chance exceptions are reported before any exception handling.This exception may be expected and handled.eax=00000000 ebx=7713b68f ecx=00000001 edx=77c55e74 esi=00000002 edi=00001772eip=0040100e esp=0012ff34 ebp=0012ff38 iopl=0 nv up ei pl zr na pe nccs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000efl=00010246*** WARNING: Unable to verify checksum for image00400000*** ERROR: Module load completed but symbols could not be loaded for image00400000image00400000+0x100e:0040100e 8b08 mov ecx,dword ptr [eax] ds:0023:00000000=????????[..]Hints for Hunting 153