sen-material: slides/slides03.tex@97ab057cbd2e (annotated)

28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	1	\documentclass[dvipsnames,14pt,t]{beamer}
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	2	\usepackage{../slides}
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	3	\usepackage{../graphics}
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	4	\usepackage{../langs}
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	5	\usepackage{../data}
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	6
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	7	\setmonofont[Scale=.88]{Consolas}
152 0c62ec6dc691 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 115 diff changeset	8	\newfontfamily{\consolas}{Consolas}
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	9
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	10	\hfuzz=220pt
111 677179c76e35 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 105 diff changeset	11
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	12	% beamer stuff
381 036a762b02cf updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 239 diff changeset	13	\renewcommand{\slidecaption}{SEN 03, King's College London}
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	14
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	15
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	16	\begin{document}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	17
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	18	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	19	\begin{frame}[t]
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	20	\frametitle{%
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	21	\begin{tabular}{@ {}c@ {}}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	22	\\
381 036a762b02cf updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 239 diff changeset	23	\LARGE Security Engineering (3)\\[-3mm]
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	24	\end{tabular}}\bigskip\bigskip\bigskip
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	25
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	26	\normalsize
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	27	\begin{center}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	28	\begin{tabular}{ll}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	29	Email: & christian.urban at kcl.ac.uk\\
111 677179c76e35 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 105 diff changeset	30	Office: & S1.27 (1st floor Strand Building)\\
105 40c51038c9e4 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 90 diff changeset	31	Slides: & KEATS (also home work is there)
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	32	\end{tabular}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	33	\end{center}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	34
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	35	\end{frame}
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	36	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	37
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	38	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	39	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	40	\frametitle{\Large Buffer Overflow Attacks}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	41
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	42	\begin{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	43	\begin{columns}[b]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	44	\begin{column}{.4\textwidth}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	45	\centering
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	46	\includegraphics[scale=0.3]{../pics/barrier.jpg}\\
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	47	lectures so far
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	48	\end{column}
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	49	\begin{column}{.4\textwidth}
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	50	\centering
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	51	\includegraphics[scale=0.32]{../pics/trainwreck.jpg}\\
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	52	today
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	53	\end{column}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	54	\end{columns}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	55	\end{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	56
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	57	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	58	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	59
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	60	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	61	\begin{frame}[c]
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	62	\frametitle{\begin{tabular}{@{}c@{}}According to\\ US Vulnerability DB\end{tabular}}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	63
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	64	\begin{center}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	65	\mbox{}\hspace{-8mm}\begin{tikzpicture}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	66	\begin{axis}[
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	67	xlabel={year},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	68	xlabel style={yshift=-1em},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	69	ylabel={\% of total attacks},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	70	ylabel style={yshift=-0em},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	71	enlargelimits=false,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	72	xtick={1997,2000,2002,...,2016},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	73	xmin=1996.5,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	74	xmax=2017,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	75	ymax=23,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	76	ytick={0,5,...,20},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	77	scaled ticks=false,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	78	axis lines=left,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	79	width=11.5cm,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	80	height=5cm,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	81	ybar,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	82	x tick label style={text height=1ex,font=\footnotesize,/pgf/number format/1000 sep={}},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	83	nodes near coords=
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	84	{\footnotesize
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	85	$\pgfmathprintnumber[fixed,fixed zerofill,precision=1,use comma]{\pgfkeysvalueof{/data point/y}}$}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	86	]
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	87	\addplot
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	88	table [x=Year,y=Percentage] {bufferoverflows.data};
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	89	\end{axis}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	90	\end{tikzpicture}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	91	\end{center}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	92
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	93
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	94	from the US National Vulnerability Database\\
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	95	\small\url{http://web.nvd.nist.gov/view/vuln/statistics}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	96	\end{frame}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	97	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	98
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	99
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	100	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	101	\begin{frame}[c]
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	102	\frametitle{Smash the Stack for Fun\ldots}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	103
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	104	\begin{itemize}
392 4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	105	\item \alert{\bf Buffer Overflow Attacks (BOAs)} or\\
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	106	{\bf Smashing the Stack Attacks}\medskip
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	107
392 4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	108	\item unfortunately one of the most popular attacks\\
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	109	($>$ 50\% of security incidents reported at CERT are related
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	110	to buffer overflows)
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	111	\begin{flushright}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	112	\small\url{http://www.kb.cert.org/vuls}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	113	\end{flushright}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	114	\medskip
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	115	\item made popular in an article from 1996 by Elias Levy
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	116	(also known as Aleph One):\\
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	117	\begin{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	118	{\bf ``Smashing The Stack For Fun and Profit''}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	119	\end{center}\medskip
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	120
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	121	\begin{flushright}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	122	\small\url{http://phrack.org/issues/49/14.html}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	123	\end{flushright}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	124
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	125	\end{itemize}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	126
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	127	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	128	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	129
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	130	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	131	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	132	\frametitle{A Long Printed ``Twice''}
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	133	\mbox{}\\[-6mm]
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	134
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	135	\footnotesize
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	136	\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C0.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	137
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	138	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	139	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	140
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	141	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	142	\begin{frame}[c]
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	143	\frametitle{Printing Out ``Zombies''}
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	144	\mbox{}\\[-6mm]
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	145
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	146	\footnotesize
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	147	\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C1.c}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	148
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	149	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	150	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	151
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	152	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	153	\begin{frame}[c]
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	154	\frametitle{A ``Login'' Function (1)}
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	155	\mbox{}\\[-6mm]
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	156
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	157	\footnotesize
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	158	\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C2a.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	159
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	160	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	161	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	162
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	163	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	164	\begin{frame}[c]
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	165	\frametitle{A ``Login'' Function (2)}
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	166	\mbox{}\\[-6mm]
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	167
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	168	\footnotesize
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	169	\lstinputlisting[language=C,xleftmargin=-3mm]{../progs/C2b.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	170
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	171	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	172	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	173
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	174	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	175	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	176	\frametitle{What the Hell Is Going On?}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	177
216 38718062709a updated C2 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 211 diff changeset	178	\begin{itemize}
38718062709a updated C2 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 211 diff changeset	179	\item Let's start with a very simple program:
38718062709a updated C2 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 211 diff changeset	180	\end{itemize}
38718062709a updated C2 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 211 diff changeset	181
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	182	\lstinputlisting[language=C,xleftmargin=4mm]{../progs/example1.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	183
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	184	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	185	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	186
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	187	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	188	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	189	\frametitle{Memory}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	190
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	191	\begin{itemize}
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	192	\item each process will get a chunk of memory that is
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	193	organised as follows:
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	194	\end{itemize}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	195
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	196	\begin{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	197	\begin{tikzpicture}[scale=0.8]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	198	%\draw[step=1cm] (-3,-3) grid (3,3);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	199	\draw[line width=1mm] (-2, -3) rectangle (2,3);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	200	\draw[line width=1mm] (-2,1) -- (2,1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	201	\draw[line width=1mm] (-2,-1) -- (2,-1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	202	\draw (0,2) node {\large\tt text};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	203	\draw (0,0) node {\large\tt heap};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	204	\draw (0,-2) node {\large\tt stack};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	205
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	206	\draw (-2.7,3) node[anchor=north east] {\tt\begin{tabular}{@{}l@{}}lower\\ address\end{tabular}};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	207	\draw (-2.7,-3) node[anchor=south east] {\tt\begin{tabular}{@{}l@{}}higher\\ address\end{tabular}};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	208	\draw[->, line width=1mm] (-2.5,3) -- (-2.5,-3);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	209
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	210	\draw (2.7,-2) node[anchor=west] {\tt grows};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	211	\draw (2.7,-3) node[anchor=south west] {\tt\footnotesize older};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	212	\draw (2.7,-1) node[anchor=north west] {\tt\footnotesize newer};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	213	\draw[\|->, line width=1mm] (2.5,-3) -- (2.5,-1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	214	\end{tikzpicture}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	215	\end{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	216
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	217	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	218	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	219
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	220	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	221	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	222	\frametitle{The Stack}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	223
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	224	\begin{textblock}{7}(1,1)
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	225	\begin{tikzpicture}[scale=0.8]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	226	%\draw[step=1cm] (-3,-1) grid (3,8);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	227	\draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	228	\draw[line width=1mm] (-1,-1.2) -- (-1,7.4);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	229	\draw[line width=1mm] ( 1,-1.2) -- ( 1,7.4);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	230	\draw (0,-1) node[anchor=south] {\tt main};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	231	\draw[line width=1mm] (-1,0) -- (1,0);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	232	\draw (0,0) node[anchor=south] {\tt arg$_3$=3};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	233	\draw[line width=1mm] (-1,1) -- (1,1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	234	\draw (0,1) node[anchor=south] {\tt arg$_2$=2};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	235	\draw[line width=1mm] (-1,2) -- (1,2);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	236	\draw (0,2) node[anchor=south] {\tt arg$_1$=1};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	237	\draw[line width=1mm] (-1,3) -- (1,3);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	238	\draw (0,3.1) node[anchor=south] {\tt ret};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	239	\draw[line width=1mm] (-1,4) -- (1,4);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	240	\draw (0,4) node[anchor=south] {\small\tt last sp};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	241	\draw[line width=1mm] (-1,5) -- (1,5);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	242	\draw (0,5) node[anchor=south] {\tt buf$_1$};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	243	\draw[line width=1mm] (-1,6) -- (1,6);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	244	\draw (0,6) node[anchor=south] {\tt buf$_2$};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	245	\draw[line width=1mm] (-1,7) -- (1,7);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	246	\draw (2,6.1) node[anchor=south] {\code{$esp}};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	247	\draw[<-,line width=0.5mm] (1.1,7) -- (2.5,7);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	248
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	249	\draw[->,line width=0.5mm] (1,4.5) -- (1.8,4.5) -- (1.8, 0) -- (1.1,0);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	250	\draw[->,line width=0.5mm] (1,3.5) -- (2.5,3.5);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	251	\draw (2.6,3.1) node[anchor=south west] {\tt back to main()};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	252
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	253	\draw[->,red,line width=2mm] (2.5,0.1) -- (4.2,0.1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	254	\end{tikzpicture}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	255	\end{textblock}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	256
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	257	\begin{textblock}{7}(6.4,8)
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	258	\begin{bubble}[6.8cm]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	259	\footnotesize
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	260	\lstinputlisting[language=C,xleftmargin=5mm]{../progs/example1.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	261	\end{bubble}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	262	\end{textblock}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	263
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	264	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	265	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	266
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	267	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	268	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	269	\frametitle{Behind the Scenes}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	270
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	271	\only<2->{
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	272	\begin{textblock}{7}(1,0.6)
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	273	\begin{bubble}[6.8cm]
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	274	\footnotesize
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	275	\lstinputlisting[language=C,
2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	276	xleftmargin=5mm,
2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	277	belowskip=-1mm,
2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	278	aboveskip=-1mm]{../progs/example1.c}
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	279	\end{bubble}
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	280	\end{textblock}}
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	281
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	282	\only<2>{
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	283	\begin{textblock}{7}(0.5,6.6)
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	284	\footnotesize
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	285	\lstinputlisting[language={[x86masm]Assembler},morekeywords={movl},xleftmargin=5mm,numbers=none]{../progs/example1a.s}
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	286	\end{textblock}}
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	287
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	288	\only<3>{
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	289	\begin{textblock}{7}(0.5,6.6)
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	290	\footnotesize
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	291	\lstinputlisting[language={[x86masm]Assembler},morekeywords={movl,movw},xleftmargin=5mm,numbers=none]{../progs/example1b.s}
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	292	\end{textblock}}
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	293
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	294	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	295	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	296
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	297	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	298	\begin{frame}[c]
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	299	\frametitle{Overwriting the Stack}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	300
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	301	\begin{textblock}{7}(1,2)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	302	\begin{tikzpicture}[scale=0.8]
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	303	%\draw[step=1cm] (-3,-1) grid (3,8);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	304	\draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	305	\draw[line width=1mm] (-1,-1.2) -- (-1,6.4);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	306	\draw[line width=1mm] ( 1,-1.2) -- ( 1,6.4);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	307	\draw (0,-1) node[anchor=south] {\tt main};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	308	\draw[line width=1mm] (-1,0) -- (1,0);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	309	\draw (0,0) node[anchor=south] {\tt arg$_3$=3};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	310	\draw[line width=1mm] (-1,1) -- (1,1);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	311	\draw (0,1) node[anchor=south] {\tt arg$_2$=2};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	312	\draw[line width=1mm] (-1,2) -- (1,2);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	313	\draw (0,2) node[anchor=south] {\tt arg$_1$=1};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	314	\draw[line width=1mm] (-1,3) -- (1,3);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	315	\draw (0,3.1) node[anchor=south] {\tt ret};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	316	\draw[line width=1mm] (-1,4) -- (1,4);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	317	\draw (0,4) node[anchor=south] {\small\tt last sp};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	318	\draw[line width=1mm] (-1,5) -- (1,5);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	319	\draw (0,5) node[anchor=south] {\tt buf};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	320	\draw[line width=1mm] (-1,6) -- (1,6);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	321	\draw (2,5.1) node[anchor=south] {\code{$esp}};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	322	\draw[<-,line width=0.5mm] (1.1,6) -- (2.5,6);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	323
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	324	\draw[->,line width=0.5mm] (1,4.5) -- (1.8,4.5);
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	325	\draw (2.5,4.1) node[anchor=south] {\code{BBBB}};
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	326
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	327	\draw[->,line width=0.5mm] (1,3.5) -- (2.5,3.5);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	328	\draw (2.6,3.1) node[anchor=south west] {\tt jump to \code{\\x080483f4}};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	329	\end{tikzpicture}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	330	\end{textblock}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	331
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	332	\begin{textblock}{7}(1,13.5)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	333	\code{char buf[8] = "AAAAAAAABBBB\\xf4\\x83\\x04\\x08\\x00"}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	334	\end{textblock}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	335
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	336	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	337	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	338
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	339	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
471 97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	340	\tikzset{alt/.code args={<#1>#2#3#4}{%
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	341	\alt<#1>{\pgfkeysalso{#2}}{\pgfkeysalso{#3}} % \pgfkeysalso doesn't change the path
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	342	}}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	343
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	344	\begin{frame}[t]
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	345	\frametitle{Buffer Overflow Attacks}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	346
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	347	\begin{itemize}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	348	\item the problem arises from the way C/C++ organises its function calls\\[-8mm]\mbox{}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	349	\end{itemize}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	350
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	351	\begin{center}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	352	\begin{tikzpicture}[scale=1]
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	353	%\draw[black!10,step=2mm] (0,0) grid (9,4);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	354	%\draw[black!10,thick,step=10mm] (0,0) grid (9,4);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	355
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	356	\node at (0.5,4.5) {\small\begin{tabular}{l}main\\[-2mm] prog.\end{tabular}};
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	357	\draw[line width=0mm, white, alt=<2->{fill=red}{fill=blue}] (0,2.5) rectangle (1,3.8);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	358	\draw[line width=0mm, white, alt=<9->{fill=red}{fill=blue}] (0,0.2) rectangle (1,0.5);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	359	\draw[line width=1mm, alt=<3->{fill=yellow}{fill=blue}] (0,2.0) rectangle (1,2.5);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	360	\draw[line width=1mm, alt=<6->{fill=red}{fill=blue}] (0,1.0) rectangle (1,2.0);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	361	\draw[line width=1mm, alt=<7->{fill=yellow}{fill=blue}] (0,0.5) rectangle (1,1.0);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	362	\draw[line width=1mm] (0,0) -- (0,4);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	363	\draw[line width=1mm] (1,0) -- (1,4);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	364
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	365	\node at (3.5,3.5) {\small\begin{tabular}{l}fact(n)\end{tabular}};
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	366	\draw[line width=1mm, alt=<{4-5,8}>{fill=red}{fill=blue}] (3,1.0) rectangle (4,3.0);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	367
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	368	\onslide<3-4>{\draw[->, line width=1mm,red] (1,2.3) to node [above,sloped,midway] {n=4} (3,3);}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	369	\onslide<5>{\draw[<-, line width=1mm,red] (1,2.3) to node [above,sloped,midway] {res=24} (3,1);}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	370
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	371	\onslide<7-8>{\draw[->, line width=1mm,red] (1,0.8) to node [above,sloped,midway] {n=3} (3,3);}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	372	\onslide<9>{\draw[<-, line width=1mm,red] (1,0.8) to node [above,sloped,midway] {res=6} (3,1);}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	373
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	374
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	375	\node at (7.75,3.9) {\small\begin{tabular}{l}stack\end{tabular}};
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	376	\draw[line width=1mm] (7,3.5) -- (7,0.5) -- (8.5,0.5) -- (8.5,3.5);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	377
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	378	\onslide<3,4,7,8>{
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	379	\node at (7.75, 1.4) {ret};
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	380	\draw[line width=1mm] (7,1.1) -- (8.5,1.1);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	381	\node at (7.75, 2.0) {sp};
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	382	\draw[line width=1mm] (7,2.3) -- (8.5,2.3);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	383	}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	384	\onslide<3,4>{
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	385	\node at (7.75, 0.8) {4};
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	386	\draw[line width=1mm] (7,1.7) -- (8.5,1.7);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	387	}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	388	\onslide<7,8>{
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	389	\node at (7.75, 0.8) {3};
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	390	\draw[line width=1mm] (7,1.7) -- (8.5,1.7);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	391	}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	392
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	393
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	394	\end{tikzpicture}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	395	\end{center}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	396
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	397	\end{frame}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	398
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	399	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	400	\begin{frame}[t]
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	401
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	402	\begin{center}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	403	\begin{tikzpicture}[scale=1]
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	404	%\draw[black!10,step=2mm] (0,0) grid (9,4);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	405	%\draw[black!10,thick,step=10mm] (0,0) grid (9,4);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	406
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	407	\node at (0.5,4.5) {\small\begin{tabular}{l}main\\[-2mm] prog.\end{tabular}};
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	408	\draw[line width=0mm, white, alt=<2->{fill=red}{fill=blue}] (0,2.5) rectangle (1,3.8);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	409	\draw[line width=1mm, white, fill=blue] (0,1.0) rectangle (1,2.0);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	410	\draw[line width=1mm, alt=<3->{fill=yellow}{fill=blue}] (0,2.0) rectangle (1,2.5);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	411	\draw[line width=1mm] (0,0) -- (0,4);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	412	\draw[line width=1mm] (1,0) -- (1,4);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	413
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	414	\node at (3.5,3.5) {\small\begin{tabular}{l}fact(n)\end{tabular}};
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	415	\draw[line width=0mm, alt=<{4-}>{red, fill=red}{blue, fill=blue}] (3,2.8) rectangle (4,3.0);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	416	\draw[line width=0mm, alt=<{5-}>{red, fill=red}{blue, fill=blue}] (3,2.8) rectangle (4,2.0);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	417	\draw[line width=0mm, alt=<{7-}>{red, fill=red}{blue, fill=blue}] (3,2.0) rectangle (4,1.0);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	418	\draw[line width=1mm] (3,1.0) rectangle (4,3.0);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	419
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	420	\onslide<3->{\draw[->, line width=1mm,red] (1,2.3) to node [above,sloped,midway] {n=4} (3,3);}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	421	\onslide<5->{\draw[<-, line width=2mm,red] (4,2) to node [above,sloped,midway]
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	422	{\begin{tabular}{l}user\\[-1mm] input\end{tabular}} (6,2);}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	423	\onslide<8->{\draw[<-, line width=1mm,red] (1,-2) to (3,1);}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	424
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	425	\node at (7.75,3.9) {\small\begin{tabular}{l}stack\end{tabular}};
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	426	\draw[line width=1mm] (7,3.5) -- (7,-0.1) -- (8.5,-0.1) -- (8.5,3.5);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	427
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	428	\onslide<3->{
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	429	\node at (7.75, 0.2) {4};
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	430	\draw[line width=1mm,alt=<6->{fill=red}{fill=white}] (7,0.5) rectangle (8.5,1.1);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	431	\node at (7.75, 0.8) {\alt<6->{@a\#}{ret}};
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	432	\draw[line width=1mm,alt=<6->{fill=red}{fill=white}] (7,1.1) rectangle (8.5,1.7);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	433	\node at (7.75, 1.4) {\alt<6->{!?w;}sp};
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	434	}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	435
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	436	\onslide<4->{
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	437	\draw[line width=1mm,fill=red] (7,1.7) rectangle (8.5,3.0);
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	438	\node[white] at (7.75, 2.4) {buffer};
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	439	}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	440
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	441	\end{tikzpicture}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	442	\end{center}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	443
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	444	\end{frame}
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	445	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	446
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	447
97ab057cbd2e updated Christian Urban <urbanc@in.tum.de> parents: 467 diff changeset	448	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	449	\begin{frame}[c]
398 b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	450	\frametitle{C-Library Functions}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	451
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	452	\begin{itemize}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	453	\item copy everything up to the zero byte
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	454	\end{itemize}\medskip
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	455
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	456	{\small
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	457	\lstinputlisting[language=C,numbers=none]{../progs/app5.c}}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	458
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	459
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	460	\end{frame}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	461	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	462
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	463
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	464
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	465	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	466	\begin{frame}[c]
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	467	\frametitle{Payloads}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	468
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	469	\begin{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	470	\item the idea is that you store some code in the buffer (the payload)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	471	\item you then override the return address to execute this payload\medskip
398 b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	472	\item normally you want to start a shell\pause
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	473	\item difficulty is to guess the right place where to ``jump''
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	474	\end{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	475
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	476	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	477	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	478
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	479	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	480	\begin{frame}[t]
239 0db764174afb updated home works Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 226 diff changeset	481	\frametitle{Starting a Shell}
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	482
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	483	\small
400 f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	484	\lstinputlisting[language=C,numbers=none,xleftmargin=-6mm]{../progs/o2.c}
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	485
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	486	\begin{textblock}{7}(5,7.5)
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	487	\begin{bubble}[7cm]
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	488	\lstinputlisting[language=C,numbers=none,xleftmargin=-0mm]{../progs/shell.c}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	489	\end{bubble}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	490	\end{textblock}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	491
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	492	\end{frame}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	493	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	494
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	495	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	496	\begin{frame}[c]
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	497	\frametitle{Avoiding \texttt{$\backslash$x00}}
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	498
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	499	\begin{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	500	\item another difficulty is that the code is not allowed to contain \texttt{$\backslash$x00}:
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	501
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	502	\begin{center}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	503	\texttt{xorl \%eax, \%eax}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	504	\end{center}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	505	\end{itemize}\bigskip\bigskip
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	506
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	507	{\small
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	508	\lstinputlisting[language=C,numbers=none]{../progs/app5.c}}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	509
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	510	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	511	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	512
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	513	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
400 f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	514	\begin{frame}[t]
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	515	\frametitle{String from the Web}
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	516
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	517	{\small
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	518	\lstinputlisting[language=C,numbers=none,xleftmargin=-6mm]{../progs/o1.c}}
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	519	\bigskip\bigskip
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	520
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	521	\noindent
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	522	More ``interesting'' shell programs can be found at
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	523
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	524	\begin{center}
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	525	\url{http://shellblade.net/shellcode.html}
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	526	\end{center}
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	527
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	528	\end{frame}
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	529	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	530
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	531	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	532	\begin{frame}[c]
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	533	\frametitle{Overflow.c}
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	534	\mbox{}\\[-6mm]
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	535
222 81f9f0eb1180 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 221 diff changeset	536	\small
81f9f0eb1180 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 221 diff changeset	537	\lstinputlisting[language=C,xleftmargin=-4mm,numbers=none]{../progs/overflow.c}
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	538
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	539
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	540	\end{frame}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	541	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	542
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	543	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	544	\begin{frame}[c]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	545	\frametitle{Optimising Success}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	546
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	547	\begin{center}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	548	\begin{tabular}{l@{\hspace{2cm}}l}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	549	\begin{tikzpicture}[scale=0.6]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	550	\draw[line width=1mm] (-2, -1) rectangle (2,3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	551	\draw[line width=1mm,fill=blue!30] (-2, 1.9) rectangle (2,3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	552	\draw (0,2.5) node {\small\tt shell code};
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	553	\draw[line width=1mm,fill=black] (0.3, -1) rectangle (2,-0.7);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	554	\draw[->,line width=0.3mm] (1.05, -1) -- (1.05,-1.7) --
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	555	(-3,-1.7) -- (-3, 3.7) -- (-1.9, 3.7) -- (-1.9, 3.1);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	556	\end{tikzpicture}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	557	&
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	558	\onslide<2>{
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	559	\begin{tikzpicture}[scale=0.6]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	560	\draw[gray!50,fill=red!30] (-2,0.3) rectangle (2,3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	561	\draw[line width=1mm] (-2, -1) rectangle (2,3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	562	\draw[line width=1mm,fill=blue!30] (-2, 0.3) rectangle (2, -0.7);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	563	\draw (0,-0.2) node {\small\tt shell code};
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	564	\draw[line width=1mm,fill=black] (0.3, -1) rectangle (2,-0.7);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	565	\draw [line width=0.5,decoration={brace,amplitude=2mm},decorate]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	566	(2.3,3) -- (2.3,0.3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	567	\draw[line width=0.3mm] (1.05, -1) -- (1.05,-1.7) --
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	568	(3,-1.7) -- (3,1.65) -- (2.6, 1.65);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	569	\end{tikzpicture}}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	570	\end{tabular}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	571	\end{center}\bigskip
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	572
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	573	\onslide<2>{
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	574	fill up the red part of the string with \pcode{NOP} operations
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	575	(Intel \texttt{$\backslash$x90})}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	576
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	577	\end{frame}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	578	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	579
398 b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	580	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	581	\begin{frame}[c]
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	582	\frametitle{Why BOAs Work?}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	583
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	584	\begin{itemize}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	585	\item stack grows from higher addresses to lower addresses
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	586	\item library functions copy memory until a zero-byte is
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	587	encountered
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	588	\end{itemize}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	589
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	590	\begin{center}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	591	\begin{tabular}{@{\hspace{-7mm}}c@{\hspace{2mm}}c@{}}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	592	\small
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	593	\begin{tikzpicture}[scale=0.45]
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	594	%\draw[step=1cm] (-3,-3) grid (3,3);
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	595	\draw[line width=1mm] (-2, -3) rectangle (2,3);
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	596	\draw[line width=1mm] (-2,1) -- (2,1);
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	597	\draw[line width=1mm] (-2,-1) -- (2,-1);
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	598	\draw (0,2) node {\tt text};
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	599	\draw (0,0) node {\tt heap};
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	600	\draw (0,-2) node {\tt stack};
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	601
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	602	\draw (-2.7,3) node[anchor=north east]
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	603	{\tt\begin{tabular}{@{}l@{}}lower\\ address\end{tabular}};
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	604	\draw (-2.7,-3) node[anchor=south east]
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	605	{\tt\begin{tabular}{@{}l@{}}higher\\ address\end{tabular}};
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	606	\draw[->, line width=1mm] (-2.5,3) -- (-2.5,-3);
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	607
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	608	\draw (2.7,-3) node[anchor=south west] {\tt\footnotesize older};
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	609	\draw (2.7,-1) node[anchor=north west] {\tt\footnotesize newer};
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	610	\draw[\|->, line width=1mm] (2.5,-3.09) -- (2.5,-1);
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	611	\end{tikzpicture}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	612	&
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	613	\raisebox{1.3cm}{\footnotesize
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	614	\lstinputlisting[language=C,numbers=none]{../progs/app5.c}}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	615	\end{tabular}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	616	\end{center}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	617
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	618	\end{frame}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	619	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	620
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	621	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	622	\begin{frame}[c]
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	623	\frametitle{Variants}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	624
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	625	There are many variants:
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	626
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	627	\begin{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	628	\item return-to-lib-C attacks
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	629	\item heap-smashing attacks\\
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	630	\textcolor{gray}{\small(Slammer Worm in 2003 infected 90\% of vulnerable systems within 10 minutes)}\bigskip
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	631
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	632	\item ``zero-days-attacks'' (new unknown vulnerability)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	633	\end{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	634
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	635	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	636	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	637
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	638	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	639	\begin{frame}[c]
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	640	\frametitle{\begin{tabular}{c}
2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	641	Protections against\\
2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	642	Buffer Overflow Attacks
2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	643	\end{tabular}}
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	644
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	645	\begin{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	646	\item use safe library functions
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	647	\item stack canaries
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	648	\item ensure stack data is not executable (can be defeated)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	649	\item address space randomisation (makes one-size-fits-all more difficult)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	650	\item choice of programming language (one of the selling points of Java)
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	651	\end{itemize}
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	652
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	653	\only<2>{
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	654	\begin{textblock}{7}(6,1)
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	655	\begin{bubble}[5.5cm]
2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	656	\begin{tabular}{cp{2.9cm}}
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	657	\begin{tikzpicture}[baseline=40mm,scale=0.8]
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	658	%\draw[step=1cm] (-3,-1) grid (3,8);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	659	\draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	660	\draw[line width=1mm] (-1,-1.2) -- (-1,7.4);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	661	\draw[line width=1mm] ( 1,-1.2) -- ( 1,7.4);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	662	\draw (0,-1) node[anchor=south] {\tt main};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	663	\draw[line width=1mm] (-1,0) -- (1,0);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	664	\draw (0,0) node[anchor=south] {\tt arg$_3$=3};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	665	\draw[line width=1mm] (-1,1) -- (1,1);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	666	\draw (0,1) node[anchor=south] {\tt arg$_2$=2};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	667	\draw[line width=1mm] (-1,2) -- (1,2);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	668	\draw (0,2) node[anchor=south] {\tt arg$_1$=1};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	669	\draw[line width=1mm] (-1,3) -- (1,3);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	670	\draw (0,3.1) node[anchor=south] {\tt ret};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	671	\draw[line width=1mm] (-1,4) -- (1,4);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	672	\draw (0,4) node[anchor=south] {\small\tt last sp};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	673	\draw[line width=1mm] (-1,5) -- (1,5);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	674	\draw (0,5) node[anchor=south] {\tt\small\alert{\textbf{random}}};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	675	\draw[line width=1mm] (-1,6) -- (1,6);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	676	\draw (0,6) node[anchor=south] {\tt buf};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	677	\draw[line width=1mm] (-1,7) -- (1,7);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	678	\end{tikzpicture} &
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	679	\raggedright stack canary: a random value after the local variables
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	680	\end{tabular}
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	681	\end{bubble}
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	682	\end{textblock}}
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	683
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	684
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	685	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	686	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	687
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	688	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	689	\begin{frame}[c]
398 b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	690	\frametitle{In my Examples I Cheated}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	691
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	692	I compiled the programs with
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	693
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	694	\begin{center}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	695	\begin{tabular}{l@{\hspace{1mm}}l}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	696	\pcode{/usr/bin/gcc} & \pcode{-ggdb -O0}\\
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	697	& \pcode{-fno-stack-protector}\\
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	698	& \pcode{-mpreferred-stack-boundary=2}\\
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	699	& \pcode{-z execstack}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	700	\end{tabular}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	701	\end{center}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	702
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	703	\end{frame}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	704	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	705
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	706
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	707
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	708	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	709	%% \begin{frame}[c]
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	710	%% \frametitle{NIST Statistics about BOA}
204 8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	711
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	712	%% \begin{center}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	713	%% \begin{tikzpicture}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	714	%% \begin{axis}[
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	715	%% xlabel={year},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	716	%% ylabel={\% of total attacks},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	717	%% ylabel style={yshift=0em},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	718	%% enlargelimits=false,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	719	%% xtick={1997,1999,2001,...,2015},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	720	%% xmin=1996.5,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	721	%% xmax=2016,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	722	%% ymax=21,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	723	%% ytick={0,5,...,20},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	724	%% scaled ticks=false,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	725	%% axis lines=left,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	726	%% width=11cm,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	727	%% height=5cm,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	728	%% ybar,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	729	%% nodes near coords=
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	730	%% {\footnotesize
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	731	%% $\pgfmathprintnumber[fixed,fixed zerofill,precision=1,use comma]{\pgfkeysvalueof{/data point/y}}$},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	732	%% x tick label style={font=\footnotesize,/pgf/number format/1000 sep={}}]
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	733	%% \addplot
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	734	%% table [x=Year,y=Percentage] {../handouts/bufferoverflows.data};
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	735	%% \end{axis}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	736	%% \end{tikzpicture}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	737	%% \end{center}
204 8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	738
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	739	%% from the US National Vulnerability Database\\
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	740	%% \small\url{http://web.nvd.nist.gov/view/vuln/statistics}
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	741
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	742	%% \end{frame}
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	743	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
204 8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	744
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	745	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	746	\begin{frame}[fragile]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	747	\frametitle{D-Link Wifi Router, BOA}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	748	\small
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	749
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	750	As a proof-of-concept, the following URL allows
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	751	attackers to control the return value saved on
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	752	the stack (the vulnerability is triggered when
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	753	executing \pcode{"/usr/sbin/widget"}):
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	754
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	755	\begin{center}\footnotesize
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	756	\pcode{curl http://<target ip>/post_login.xml?hash=AAA...AAABBBB}
204 8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	757	\end{center}
8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	758
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	759	The value of the "hash" HTTP GET parameter consists of
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	760	292 occurrences of the \pcode{'A'} character, followed by four
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	761	occurrences of character \pcode{'B'}. In our lab setup, characters
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	762	\pcode{'B'} overwrite the saved program counter (\pcode{\%ra}).\bigskip
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	763
3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	764
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	765	\begin{tabular}{@{}ll}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	766	Discovery date: & 06/03/2013\\
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	767	Release date: & 02/08/2013
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	768	\end{tabular}\bigskip
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	769
3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	770
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	771	\footnotesize
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	772	\hfill\url{http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	773	\end{frame}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	774	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	775
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	776	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	777	\begin{frame}[fragile]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	778	\frametitle{GHOST in Glibc}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	779
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	780	\small The GHOST vulnerability is a buffer overflow condition
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	781	that can be easily exploited locally and remotely. This
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	782	vulnerability is named after the GetHOSTbyname function
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	783	involved in the exploit.\medskip
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	784
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	785	The attack allows the attacker to execute arbitrary code and
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	786	take control of the victim’s vulnerable machine.
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	787	Unfortunately, the vulnerability exists in the GNU C Library
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	788	(glibc), a code library originally released in 2000, meaning
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	789	it has been widely distributed. Although an update released by
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	790	Linux in 2013 mitigated this vulnerability, most systems and
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	791	products have not installed the patch.\medskip
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	792
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	793
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	794	\begin{tabular}{@{}ll}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	795	Release date: & 01/28/2015
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	796	\end{tabular}\smallskip
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	797
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	798
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	799	\footnotesize
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	800	\hfill\url{https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	801	\end{frame}
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	802	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	803
392 4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	804	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	805	\begin{frame}[c]
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	806	\frametitle{Format String Vulnerability}
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	807
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	808	\small
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	809	\texttt{string} is nowhere used:\bigskip
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	810
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	811	{\footnotesize\lstinputlisting[language=C]{../progs/C4.c}}\bigskip
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	812
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	813	this vulnerability can be used to read out the stack
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	814
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	815	\end{frame}
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	816	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	817
113 0332f8102121 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 112 diff changeset	818
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	819	\end{document}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	820
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	821	%%% Local Variables:
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	822	%%% mode: latex
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	823	%%% TeX-master: t
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	824	%%% End:
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	825

author	Christian Urban <urbanc@in.tum.de>
	Sat, 08 Oct 2016 13:54:14 +0100
changeset 471	97ab057cbd2e
parent 467	da4896f201b5
child 479	f76074ed6c9e
permissions	-rw-r--r--