SECURE PROGRAMMING Chapter 3 Pointer Subterfuge Overview Introduction

SECURE PROGRAMMING Chapter 3 Pointer Subterfuge

Overview ● Introduction ● Data Locations ● Structured ● Function Pointers ● System default ● Modifying the IP ● Global Offset Table ● Stack Canaries ● The. dtors Section ● W^X ● Virtual Pointers ● ● atexit() and on_exit() ● longjmp()/setjmp() ● ● ● Exception Handling Mitigation Strategies Encoding/decodin g pointers Summary

Introduction Pointer subterfuge == modifying pointer values Pointers to objects vs pointers to functions C++ also defines pointer to member type All can be modified to run arbitrary code. First examine relationship data declaration/storage

Data Locations Overwriting a pointer with a buffer overflow: ➢ Limited by upper bound ➢ Limited by lower bound ➢ Limited by Hi ➢ Limited by Lo ➢ Limited by special marker (usually null) Conditions: Buffer and pointer must be in same segment. Pointer must be in direction of overflow Buffer not adequately bounded

Data Locations Data allocation: Unix: data and BSS segment (example 3. 1, page 123) Windows is similar

Data Locations

Function Pointers

Object Pointers

Modifying the Instruction Pointer

Global Offset Table Windows and Linux use a similar mechanism for linking and transferring control to library fns. Windows solution is safe. Linux solution is exploitable. Default binary format on Linux is called Executable and Linking Format (ELF), Developed by Unix System Labs as part of the application binary interface. Includes a “Global Offset Table” (GOT)

Global Offset Table (GOT) Holds absolute addresses of library functions program text is still position independent program text can still be shared Initially entry to Run-Time Linker Address of GOT is fixed. Address of GOT entry is fixed in the executable. Obtainable through objdump –dynamic-reloc xx command. (undocumented!!)

Global Offset Table (GOT) Windows portable executable (PE) file format is similar to ELF: Array of data structures for each imported DLL Name → array of function pointers (Import Address Table, IAT) Once module is loaded (at load time), IAT entries are write protected.

The. dtors Section __atribute__ for functions (like constructor (called before main) or destructor (called after main exits)) Examine with: objdump -s -j. dtors <fname>

Virtual Pointers (pp 132/133, not used yet)

atexit() and on_exit() (See code, manual pages)

longjmp() pp 135, 136

Exception Handling Windows has three types: Vectored exception handling Structured exception handling (try/catch) System defaults Unix has three: Vectored exception handling Structured exception handling (try/catch) System defaults (see man signal, man sigprocmask)

Structured Exception Handling Windows guarantees on page 138

System Default Exception Handling Interrupt vector: Windows encodes pointer addresses, making it difficult for crackers.

Mitigation Strategies Eliminate the vulnerabilities: Stack canaries W^X Encode/decode function pointers (pp 140 -141

Summary