defeating-xpsp2-heap-protection.pdf
需积分: 3 45 浏览量
2008-10-09
17:28:39
上传
评论
收藏 90KB PDF 举报
Defeating Microsoft Windows XP SP2 Heap protection
and DEP bypass
Alexander Anisimov, Positive Technologies.
( anisimov[at]ptsecurity.com, HTTP://WWW.PTSECURITY.COM )
Overview
Memory protection
Buffer overrun attacks are among the most common mechanisms, or vectors, for intrusion
into computers. In this type of exploit, the attacker sends a long string to an input stream
or control – longer than the memory buffer allocated to hold it. The long string injects code
into the system, which is executed, launching a virus or worm.
Windows XP Service Pack 2 uses two general categories of protection measures to inhibit
buffer-overrun attacks. On CPUs that support it, the operating system can turn on the
execution protection bit for virtual memory pages that are supposed to hold only data. On
all CPUs, the operating system is now more careful to reduce both stack and heap buffer
overruns, using "sandboxing" techniques.
Execution Protection (NX)
On the 64-bit AMD K8 and Intel Itanium processor families, the CPU hardware can mark
memory with an attribute that indicates that code should not be executed from that
memory. This execution protection (NX) feature functions on a per-virtual memory page
basis, most often changing a bit in the page table entry to mark the memory page.
On these processors, Windows XP Service Pack 2 uses the execution protection feature to
prevent the execution of code from data pages. When an attempt is made to run code from
a marked data page, the processor hardware raises an exception immediately and prevents
the code from executing. This prevents attackers from overrunning a data buffer with code
and then executing the code; it would have stopped the Blaster worm dead in its tracks.
Although the support for this feature is currently limited to 64-bit processors, Microsoft
expects future 32-bit and 64-bit processors to provide execution protection.
Sandboxing
To help control this type of attack on existing 32-bit processors, Service Pack 2 adds
software checks to the two types of memory storage used by native code: the stack, and
the heap. The stack is used for temporary local variables with short lifetimes; stack space is
automatically allocated when a function is called and released when the function exits. The
heap is used by programs to dynamically allocate and free memory blocks that may have
longer lifetimes.
The protection added to these two kinds of memory structures is called sandboxing. To
protect the stack, all binaries in the system have been recompiled using an option that
enables stack buffer security checks. A few instructions added to the calling and return
sequences for functions allow the runtime libraries to catch most stack buffer overruns. This
is a case where a little paranoia goes a long way.
In addition, "cookies" have been added to the heap. These are special markers at the
beginning and ends of allocated buffers, which the runtime libraries check as memory blocks
are allocated and freed. If the cookies are found to be missing or inconsistent, the runtime
libraries know that a heap buffer overrun has occurred, and raise a software exception.
- from Microsoft.com
剩余11页未读，继续阅读
评论0
最新资源