stack canary泄露方法

最新推荐文章于 2024-04-01 17:04:41 发布

winsunxu

最新推荐文章于 2024-04-01 17:04:41 发布

阅读量645

点赞数

分类专栏： linux漏洞利用技术文章标签：漏洞利用 pwn canary

本文链接：https://blog.csdn.net/winsunxu/article/details/128897046

版权

本文详细介绍了栈 Canary 的概念，一种用于防止栈溢出的安全机制。通过分析漏洞程序 `vuln.c`，揭示了 Canary 保护如何在函数调用期间启用，并探讨了两种绕过 Canary 保护的方案，特别是利用 `printf` 函数泄露 Canary 值的方法。文章还讨论了 canary 的偏移计算和其在函数栈地址空间的位置。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

什么是canary

security cookies，Assume that at the beginning of a function call (e.g. during its prologue) we are saving a value in the function’s stack frame, we would expect (! if everything went well !) to read the same value just before the function exits or namely at its epilogue. If the value has changed, then the execution of the program will be terminated and an error message will be displayed. [1]

Obviously, this protection mechanism is added by the compiler during the compilation process. For the

GNU Compiler Collection (gcc), it is implemented via the StackGuard extension which was added to gcc 2.7.2.2 [1]

Bypass stack canary