堆噴射 - 天天看點

堆噴射主要用于繞過ASLR。下面示範堆噴射分析與效果。

1.代碼

void heap_spray()

{

　　char chunk[LEN] = { 0 };

　　memset(chunk, 0x90, LEN - 10);

　　strcat(chunk, "shellcode");

　　for (int i = 0;i < 100;i++)

　　{

　　　　void *p = malloc(LEN);

　　　　strcpy((char *)p, chunk);

　　　　printf("spray %d\n", i);

　　}

2.windbg分析

_HEAP 002a0000

　　Segments 00000001

　　Reserved bytes 00100000

　　Committed bytes 0009c000

　　VirtAllocBlocks 00000000

　　VirtAlloc bytes 00000000

_HEAP 00020000...

　　　Type:

MEM_IMAGE	映射的檔案屬于可執行映像一部分的記憶體。
MEM_MAPPED	映射的檔案不屬于可執行映像一部分的記憶體。這種記憶體包含哪些從頁面檔案映射的記憶體。
MEM_PRIVATE	私有的(即不和其他程序共享)并且未用來映射任何檔案的記憶體。

　　　State

MEM_COMMIT	目前已送出給目标使用的所有記憶體。已經在實體記憶體或者頁面檔案中為這些記憶體配置設定了實體的存儲空間。
MEM_RESERVE	所有為目标以後的使用保留的記憶體。這種記憶體還沒有配置設定實體上的存儲空間。
MEM_FREE	目标虛拟位址空間中所有可用記憶體。包括所有未送出并且未保留的記憶體。該Filter 值和RegionUsageFree一樣。

Protect:

Filter value	Memory regions displayed
PAGE_NOACCESS	Memory that cannot be accessed.
PAGE_READONLY	Memory that is readable, but not writable and not executable.
PAGE_READWRITE	Memory that is readable and writable, but not executable.
PAGE_WRITECOPY	Memory that has copy-on-write behavior.
PAGE_EXECUTE	Memory that is executable, but not readable and not writeable.
PAGE_EXECUTE_READ	Memory that is executable and readable, but not writable.
PAGE_EXECUTE_READWRITE	Memory that is executable, readable, and writable.
PAGE_EXECUTE_WRITECOPY	Memory that is executable and has copy-on-write behavior.
PAGE_GUARD	Memroy that acts as a guard page.
PAGE_NOCACHE	Memory that is not cached.
PAGE_WRITECOMBINE	Memory that has write-combine access enabled.