Bug Hunter Diary

Table 4-2: List of the Assembler Instructions and the Result of Each InstructionInstructionResultlea ebp,[ebx+ebx*4] ebp = ebx + ebx * 4(The EBX register contains the user-definedvalue of current_track (0xaaaaaaaa).)mov eax,DWORD PTR [esp+0x34] eax = array index imov edx,DWORD PTR [esi+0x10] edx = fourxm->tracksshl ebp,0x2 ebp = ebp tracks[current_track].adpcm = eax; oredx[ebp + 0x10] = eax;Or in a more simplified form:edx + (ebx * 20) + 0x10 = destination address of the write operationI supplied the value 0xaaaaaaaa for current_track (EBX register), sothe calculation should look like this:NULL + (0xaaaaaaaa * 20) + 0x10 = 0x55555558The result of 0x55555558 can be confirmed with the help of thedebugger:(gdb) x/1x $edx+$ebp+0x100x55555558: Cannot access memory at address 0x55555558Step 4: Manipulate the strk Chunk to Gain Control over EIPThe vulnerability allowed me to overwrite nearly arbitrary memoryaddresses with any 4-byte value. To gain control of the execution flowof FFmpeg, I had to overwrite a memory location that would allow meto control the EIP register. I had to find a stable address, one that waspredictable within the address space of FFmpeg. That ruled out allstack addresses of the process. But the Executable and Linkable Format(ELF ) used by Linux provides an almost perfect target: the Global OffsetTable (GOT). Every library function used in FFmpeg has a referencein the GOT. By manipulating GOT entries, I could easily gain controlof the execution flow (see Section A.4). The good thing about theGOT is that it’s predictable, which is exactly what I needed. I couldgain control of EIP by overwriting the GOT entry of a library functionthat is called after the vulnerability happens.NULL Pointer FTW 61