ForumsHQ

..came heap overflows....does anyone know much about heap overflows?



buffer overflows are pretty easy to understand..you basically are exploiting system calls relative to the operating system that have no bounds checking on them.... filling up a buffer with athe return memory address of your code on the stack.. written in int 80h* specific to that OS...







*system call assembly for operating systems.. you push the arguments of the system call in reverse order to the stack.. then make eax equal to the system call you wish to execute.. (prototypes of each system call are usually provided in syscalls.master for instance on FreeBSD)



sample:

#2 void write(int *output, char *string, int *strlen){}



movl $0x(sizeof(string)), %ebx

movl (string), %ecx

movl $0x1, %edx // 1= stdout

movl $0x2, %eax // 2 = write system call

pushl %eax

int $0x80





ofcourse to inject that at the end of your string in a buffer overflow you'd have to compile it and dump the hex and append it to your return address string...





now.. how do heap overflows work?

is that like a quiz question, or do you really not know?

i really don't know...



but buffer overflows visually:



(system call with no bounds checking)

[----------buffer------ ]

(exploit)

[code][return address]





simple....