扫一扫关注公众号，长期致力于安全研究
前言：通过Windbg进行分析GS
自己简单写一个小程序，将编译器开启GS，并生成即可。
void test(char* buffer){printf("~~~~~~~~~~~~~~~~~~~");getchar();char string[8];strcpy(string, buffer);}int _tmain(int argc, _TCHAR* argv[]){char buffer[] = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";test(buffer);return 0;}
Windbg调试之后，可以发现GS的异常函数已经调用，通过栈回溯发现test函数发生了溢出。
0:000> k# ChildEBP RetAddr00 0019f8c0 0041212e GS__!failwithmessage+0x1dd [f:ddvctoolscrtcrtw32rtcerror.cpp @ 222]01 0019fce8 004116a6 GS__!_RTC_StackFailure+0xee [f:ddvctoolscrtcrtw32rtcerror.cpp @ 331]02 0019fd08 00413d3d GS__!_RTC_CheckStackVars+0x46 [f:ddvctoolscrtcrtw32rtcstack.cpp @ 75]03 0019fdf8 41414141 GS__!test+0x6d [c:usersadministratordocumentsvisual studio 2013projectsgs调试gs调试gs调试.cpp @ 12]WARNING: Frame IP not in any known module. Following frames may be wrong.04 0019fe00 41414141 0x4141414105 0019fe04 41414141 0x4141414106 0019fe08 41414141 0x4141414107 0019fe0c 41414141 0x4141414108 0019fe10 41414141 0x4141414109 0019fe14 41414141 0x414141410a 0019fe18 41414141 0x414141410b 0019ff18 00411a49 0x414141410c 0019ff68 00411c3d GS__!__tmainCRTStartup+0x199 [f:ddvctoolscrtcrtw32dllstuffcrtexe.c @ 623]0d 0019ff70 773ef989 GS__!wmainCRTStartup+0xd [f:ddvctoolscrtcrtw32dllstuffcrtexe.c @ 466]0e 0019ff80 77747084 KERNEL32!BaseThreadInitThunk+0x190f 0019ffdc 77747054 ntdll!__RtlUserThreadStart+0x2f10 0019ffec 00000000 ntdll!_RtlUserThreadStart+0x1b
进行test函数分析，在下方黑颜色处，就可以找到GS初始化的时候了，通过xor eax,ebp并存入了ebp-4局部变量中。
0:000> uf GS__!test[c:usersadministratordocumentsvisual studio 2013projectsgs调试gs调试gs调试.cpp @ 6]:6 00413cd0 55 push ebp6 00413cd1 8bec mov ebp,esp6 00413cd3 81ecd4000000 sub esp,0D4h6 00413cd9 53 push ebx6 00413cda 56 push esi6 00413cdb 57 push edi6 00413cdc 8dbd2cffffff lea edi,[ebp-0D4h]6 00413ce2 b935000000 mov ecx,35h6 00413ce7 b8cccccccc mov eax,0CCCCCCCCh6 00413cec f3ab rep stos dword ptr es:[edi]00413cee a100804100 mov eax,dword ptr [GS__!__security_cookie (00418000)]00413cf3 33c5 xor eax,ebp00413cf5 8945fc mov dword ptr [ebp-4],eax7 00413cf8 8bf4 mov esi,esp7 00413cfa 6858584100 push offset GS__!`string' (00415858)7 00413cff ff151c914100 call dword ptr [GS__!_imp__printf (0041911c)]7 00413d05 83c404 add esp,47 00413d08 3bf4 cmp esi,esp7 00413d0a e83bd4ffff call GS__!ILT+325(__RTC_CheckEsp) (0041114a)8 00413d0f 8bf4 mov esi,esp8 00413d11 ff1518914100 call dword ptr [GS__!_imp__getchar (00419118)]8 00413d17 3bf4 cmp esi,esp8 00413d19 e82cd4ffff call GS__!ILT+325(__RTC_CheckEsp) (0041114a)10 00413d1e 8b4508 mov eax,dword ptr [ebp+8]10 00413d21 50 push eax10 00413d22 8d4df0 lea ecx,[ebp-10h]10 00413d25 51 push ecx10 00413d26 e884d3ffff call GS__!ILT+170(_strcpy) (004110af)10 00413d2b 83c408 add esp,812 00413d2e 52 push edx12 00413d2f 8bcd mov ecx,ebp12 00413d31 50 push eax12 00413d32 8d15603d4100 lea edx,[GS__!test+0x90 (00413d60)]12 00413d38 e84fd3ffff call GS__!ILT+135(_RTC_CheckStackVars (0041108c)12 00413d3d 58 pop eax12 00413d3e 5a pop edx12 00413d3f 5f pop edi12 00413d40 5e pop esi12 00413d41 5b pop ebx12 00413d42 8b4dfc mov ecx,dword ptr [ebp-4]12 00413d45 33cd xor ecx,ebp12 00413d47 e8d2d2ffff call GS__!ILT+25(__security_check_cookie (0041101e)12 00413d4c 81c4d4000000 add esp,0D4h12 00413d52 3bec cmp ebp,esp12 00413d54 e8f1d3ffff call GS__!ILT+325(__RTC_CheckEsp) (0041114a)12 00413d59 8be5 mov esp,ebp12 00413d5b 5d pop ebp
00413d42 8b4dfc mov ecx,dword ptr [ebp-4]12 00413d45 33cd xor ecx,ebp12 00413d47 e8d2d2ffff call GS__!ILT+25(__security_check_cookie (0041101e)
通过跟进校验函数可以发现，其实就是通过一个cmp进行比较ecx与原Cookie的一个校验
如果匹配不上的话，就进行了退出
下方扫一下扫，即可关注
本文始发于微信公众号（安全族）：Windbg栈回溯分析GS
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论