堆喷射 - 天天看点

堆喷射主要用于绕过ASLR。下面演示堆喷射分析与效果。

1.代码

void heap_spray()

{

　　char chunk[LEN] = { 0 };

　　memset(chunk, 0x90, LEN - 10);

　　strcat(chunk, "shellcode");

　　for (int i = 0;i < 100;i++)

　　{

　　　　void *p = malloc(LEN);

　　　　strcpy((char *)p, chunk);

　　　　printf("spray %d\n", i);

　　}

2.windbg分析

_HEAP 002a0000

　　Segments 00000001

　　Reserved bytes 00100000

　　Committed bytes 0009c000

　　VirtAllocBlocks 00000000

　　VirtAlloc bytes 00000000

_HEAP 00020000...

　　　Type:

MEM_IMAGE	映射的文件属于可执行映像一部分的内存。
MEM_MAPPED	映射的文件不属于可执行映像一部分的内存。这种内存包含哪些从页面文件映射的内存。
MEM_PRIVATE	私有的(即不和其他进程共享)并且未用来映射任何文件的内存。

　　　State

MEM_COMMIT	当前已提交给目标使用的所有内存。已经在物理内存或者页面文件中为这些内存分配了物理的存储空间。
MEM_RESERVE	所有为目标以后的使用保留的内存。这种内存还没有分配物理上的存储空间。
MEM_FREE	目标虚拟地址空间中所有可用内存。包括所有未提交并且未保留的内存。该Filter 值和RegionUsageFree一样。

Protect:

Filter value	Memory regions displayed
PAGE_NOACCESS	Memory that cannot be accessed.
PAGE_READONLY	Memory that is readable, but not writable and not executable.
PAGE_READWRITE	Memory that is readable and writable, but not executable.
PAGE_WRITECOPY	Memory that has copy-on-write behavior.
PAGE_EXECUTE	Memory that is executable, but not readable and not writeable.
PAGE_EXECUTE_READ	Memory that is executable and readable, but not writable.
PAGE_EXECUTE_READWRITE	Memory that is executable, readable, and writable.
PAGE_EXECUTE_WRITECOPY	Memory that is executable and has copy-on-write behavior.
PAGE_GUARD	Memroy that acts as a guard page.
PAGE_NOCACHE	Memory that is not cached.
PAGE_WRITECOMBINE	Memory that has write-combine access enabled.