sen-material: slides/slides03.tex@a612dd3ddc81 (annotated)

28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	1	\documentclass[dvipsnames,14pt,t]{beamer}
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	2	\usepackage{../slides}
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	3	\usepackage{../graphics}
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	4	\usepackage{../langs}
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	5
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	6	\setmonofont[Scale=.88]{Consolas}
152 0c62ec6dc691 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 115 diff changeset	7	\newfontfamily{\consolas}{Consolas}
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	8
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	9	\hfuzz=220pt
111 677179c76e35 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 105 diff changeset	10
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	11	% beamer stuff
381 036a762b02cf updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 239 diff changeset	12	\renewcommand{\slidecaption}{SEN 03, King's College London}
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	13
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	14
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	15	\begin{document}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	16
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	17	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	18	\begin{frame}[t]
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	19	\frametitle{%
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	20	\begin{tabular}{@ {}c@ {}}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	21	\\
381 036a762b02cf updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 239 diff changeset	22	\LARGE Security Engineering (3)\\[-3mm]
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	23	\end{tabular}}\bigskip\bigskip\bigskip
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	24
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	25	\normalsize
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	26	\begin{center}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	27	\begin{tabular}{ll}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	28	Email: & christian.urban at kcl.ac.uk\\
111 677179c76e35 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 105 diff changeset	29	Office: & S1.27 (1st floor Strand Building)\\
105 40c51038c9e4 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 90 diff changeset	30	Slides: & KEATS (also home work is there)
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	31	\end{tabular}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	32	\end{center}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	33
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	34	\end{frame}
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	35	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	36
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	37	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	38	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	39	\frametitle{\Large Buffer Overflow Attacks}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	40
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	41	\begin{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	42	\begin{columns}[b]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	43	\begin{column}{.4\textwidth}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	44	\centering
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	45	\includegraphics[scale=0.3]{../pics/barrier.jpg}\\
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	46	lectures so far
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	47	\end{column}
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	48	\begin{column}{.4\textwidth}
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	49	\centering
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	50	\includegraphics[scale=0.32]{../pics/trainwreck.jpg}\\
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	51	today
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	52	\end{column}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	53	\end{columns}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	54	\end{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	55
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	56	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	57	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	58
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	59	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	60	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	61	\frametitle{Smash the Stack for Fun\ldots}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	62
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	63	\begin{itemize}
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	64	\item {\bf Buffer Overflow Attacks} or\\
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	65	{\bf Smashing the Stack Attacks}\medskip
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	66
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	67	\item one of the most popular attacks, unfortunately\\
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	68	($>$ 50\% of security incidents reported at CERT are related
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	69	to buffer overflows)
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	70	\begin{flushright}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	71	\small\url{http://www.kb.cert.org/vuls}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	72	\end{flushright}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	73	\medskip
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	74	\item made popular in an article from 1996 by Elias Levy
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	75	(also known as Aleph One):\\
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	76	\begin{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	77	{\bf ``Smashing The Stack For Fun and Profit''}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	78	\end{center}\medskip
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	79
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	80	\begin{flushright}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	81	\small\url{http://phrack.org/issues/49/14.html}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	82	\end{flushright}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	83
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	84	\end{itemize}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	85
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	86	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	87	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	88
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	89	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	90	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	91	\frametitle{A Long Printed ``Twice''}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	92	\mbox{}\\[-10mm]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	93
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	94	\footnotesize
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	95	\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C0.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	96
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	97	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	98	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	99
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	100	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	101	\begin{frame}[c]
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	102	\frametitle{Printing Out ``Zombies''}
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	103	\mbox{}\\[-10mm]
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	104
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	105	\footnotesize
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	106	\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C1.c}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	107
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	108	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	109	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	110
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	111	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	112	\begin{frame}[c]
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	113	\frametitle{A ``Login'' Function (1)}
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	114	\mbox{}\\[-10mm]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	115
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	116	\footnotesize
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	117	\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C2a.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	118
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	119	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	120	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	121
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	122	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	123	\begin{frame}[c]
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	124	\frametitle{A ``Login'' Function (2)}
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	125	\mbox{}\\[-10mm]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	126
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	127	\footnotesize
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	128	\lstinputlisting[language=C,xleftmargin=-3mm]{../progs/C2b.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	129
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	130	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	131	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	132
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	133	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	134	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	135	\frametitle{What the Hell Is Going On?}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	136
216 38718062709a updated C2 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 211 diff changeset	137	\begin{itemize}
38718062709a updated C2 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 211 diff changeset	138	\item Let's start with a very simple program:
38718062709a updated C2 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 211 diff changeset	139	\end{itemize}
38718062709a updated C2 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 211 diff changeset	140
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	141	\lstinputlisting[language=C,xleftmargin=4mm]{../progs/example1.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	142
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	143	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	144	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	145
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	146	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	147	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	148	\frametitle{Memory}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	149
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	150	\begin{itemize}
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	151	\item each process will get a chunk of memory that is
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	152	organised as follows:
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	153	\end{itemize}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	154
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	155	\begin{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	156	\begin{tikzpicture}[scale=0.8]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	157	%\draw[step=1cm] (-3,-3) grid (3,3);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	158	\draw[line width=1mm] (-2, -3) rectangle (2,3);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	159	\draw[line width=1mm] (-2,1) -- (2,1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	160	\draw[line width=1mm] (-2,-1) -- (2,-1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	161	\draw (0,2) node {\large\tt text};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	162	\draw (0,0) node {\large\tt heap};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	163	\draw (0,-2) node {\large\tt stack};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	164
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	165	\draw (-2.7,3) node[anchor=north east] {\tt\begin{tabular}{@{}l@{}}lower\\ address\end{tabular}};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	166	\draw (-2.7,-3) node[anchor=south east] {\tt\begin{tabular}{@{}l@{}}higher\\ address\end{tabular}};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	167	\draw[->, line width=1mm] (-2.5,3) -- (-2.5,-3);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	168
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	169	\draw (2.7,-2) node[anchor=west] {\tt grows};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	170	\draw (2.7,-3) node[anchor=south west] {\tt\footnotesize older};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	171	\draw (2.7,-1) node[anchor=north west] {\tt\footnotesize newer};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	172	\draw[\|->, line width=1mm] (2.5,-3) -- (2.5,-1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	173	\end{tikzpicture}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	174	\end{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	175
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	176	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	177	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	178
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	179	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	180	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	181	\frametitle{The Stack}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	182
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	183	\begin{textblock}{7}(1,1)
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	184	\begin{tikzpicture}[scale=0.8]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	185	%\draw[step=1cm] (-3,-1) grid (3,8);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	186	\draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	187	\draw[line width=1mm] (-1,-1.2) -- (-1,7.4);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	188	\draw[line width=1mm] ( 1,-1.2) -- ( 1,7.4);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	189	\draw (0,-1) node[anchor=south] {\tt main};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	190	\draw[line width=1mm] (-1,0) -- (1,0);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	191	\draw (0,0) node[anchor=south] {\tt arg$_3$=3};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	192	\draw[line width=1mm] (-1,1) -- (1,1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	193	\draw (0,1) node[anchor=south] {\tt arg$_2$=2};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	194	\draw[line width=1mm] (-1,2) -- (1,2);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	195	\draw (0,2) node[anchor=south] {\tt arg$_1$=1};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	196	\draw[line width=1mm] (-1,3) -- (1,3);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	197	\draw (0,3.1) node[anchor=south] {\tt ret};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	198	\draw[line width=1mm] (-1,4) -- (1,4);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	199	\draw (0,4) node[anchor=south] {\small\tt last sp};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	200	\draw[line width=1mm] (-1,5) -- (1,5);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	201	\draw (0,5) node[anchor=south] {\tt buf$_1$};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	202	\draw[line width=1mm] (-1,6) -- (1,6);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	203	\draw (0,6) node[anchor=south] {\tt buf$_2$};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	204	\draw[line width=1mm] (-1,7) -- (1,7);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	205	\draw (2,6.1) node[anchor=south] {\code{$esp}};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	206	\draw[<-,line width=0.5mm] (1.1,7) -- (2.5,7);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	207
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	208	\draw[->,line width=0.5mm] (1,4.5) -- (1.8,4.5) -- (1.8, 0) -- (1.1,0);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	209	\draw[->,line width=0.5mm] (1,3.5) -- (2.5,3.5);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	210	\draw (2.6,3.1) node[anchor=south west] {\tt back to main()};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	211
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	212	\draw[->,red,line width=2mm] (2.5,0.1) -- (4.2,0.1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	213	\end{tikzpicture}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	214	\end{textblock}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	215
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	216	\begin{textblock}{7}(6.4,8)
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	217	\begin{bubble}[6.8cm]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	218	\footnotesize
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	219	\lstinputlisting[language=C,xleftmargin=5mm]{../progs/example1.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	220	\end{bubble}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	221	\end{textblock}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	222
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	223	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	224	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	225
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	226	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	227	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	228	\frametitle{Behind the Scenes}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	229
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	230	\only<2->{
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	231	\begin{textblock}{7}(1,1)
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	232	\begin{bubble}[6.8cm]
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	233	\footnotesize
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	234	\lstinputlisting[language=C,xleftmargin=5mm]{../progs/example1.c}
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	235	\end{bubble}
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	236	\end{textblock}}
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	237
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	238	\only<2>{
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	239	\begin{textblock}{7}(5,8)
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	240	\footnotesize
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	241	\lstinputlisting[language={[x86masm]Assembler},morekeywords={movl},xleftmargin=5mm,numbers=none]{../progs/example1a.s}
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	242	\end{textblock}}
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	243
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	244	\only<3>{
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	245	\begin{textblock}{7}(5,8)
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	246	\footnotesize
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	247	\lstinputlisting[language={[x86masm]Assembler},morekeywords={movl,movw},xleftmargin=5mm,numbers=none]{../progs/example1b.s}
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	248	\end{textblock}}
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	249
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	250	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	251	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	252
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	253	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	254	\begin{frame}[c]
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	255	\frametitle{Overwriting the Stack}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	256
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	257	\begin{textblock}{7}(1,2)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	258	\begin{tikzpicture}[scale=0.8]
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	259	%\draw[step=1cm] (-3,-1) grid (3,8);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	260	\draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	261	\draw[line width=1mm] (-1,-1.2) -- (-1,6.4);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	262	\draw[line width=1mm] ( 1,-1.2) -- ( 1,6.4);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	263	\draw (0,-1) node[anchor=south] {\tt main};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	264	\draw[line width=1mm] (-1,0) -- (1,0);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	265	\draw (0,0) node[anchor=south] {\tt arg$_3$=3};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	266	\draw[line width=1mm] (-1,1) -- (1,1);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	267	\draw (0,1) node[anchor=south] {\tt arg$_2$=2};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	268	\draw[line width=1mm] (-1,2) -- (1,2);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	269	\draw (0,2) node[anchor=south] {\tt arg$_1$=1};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	270	\draw[line width=1mm] (-1,3) -- (1,3);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	271	\draw (0,3.1) node[anchor=south] {\tt ret};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	272	\draw[line width=1mm] (-1,4) -- (1,4);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	273	\draw (0,4) node[anchor=south] {\small\tt last sp};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	274	\draw[line width=1mm] (-1,5) -- (1,5);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	275	\draw (0,5) node[anchor=south] {\tt buf};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	276	\draw[line width=1mm] (-1,6) -- (1,6);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	277	\draw (2,5.1) node[anchor=south] {\code{$esp}};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	278	\draw[<-,line width=0.5mm] (1.1,6) -- (2.5,6);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	279
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	280	\draw[->,line width=0.5mm] (1,4.5) -- (1.8,4.5);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	281	\draw (2.5,4.1) node[anchor=south] {\code{??}};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	282
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	283	\draw[->,line width=0.5mm] (1,3.5) -- (2.5,3.5);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	284	\draw (2.6,3.1) node[anchor=south west] {\tt jump to \code{\\x080483f4}};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	285	\end{tikzpicture}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	286	\end{textblock}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	287
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	288	\begin{textblock}{7}(1,13.5)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	289	\code{char buf[8] = "AAAAAAAABBBB\\xf4\\x83\\x04\\x08\\x00"}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	290	\end{textblock}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	291
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	292	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	293	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	294
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	295	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	296	\begin{frame}[c]
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	297	\frametitle{Payloads}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	298
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	299	\begin{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	300	\item the idea is that you store some code in the buffer (the payload)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	301	\item you then override the return address to execute this payload\medskip
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	302	\item normally you start a root-shell\pause
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	303	\item difficulty is to guess the right place where to ``jump''
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	304	\end{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	305
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	306	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	307	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	308
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	309	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	310	\begin{frame}[t]
239 0db764174afb updated home works Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 226 diff changeset	311	\frametitle{Starting a Shell}
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	312
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	313	\small
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	314	\lstinputlisting[language=C,numbers=none,xleftmargin=-6mm]{../progs/o1.c}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	315
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	316	\begin{textblock}{7}(5,7.5)
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	317	\begin{bubble}[7cm]
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	318	\lstinputlisting[language=C,numbers=none,xleftmargin=-0mm]{../progs/shell.c}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	319	\end{bubble}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	320	\end{textblock}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	321
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	322	\end{frame}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	323	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	324
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	325	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	326	\begin{frame}[c]
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	327	\frametitle{Avoiding \texttt{$\backslash$x00}}
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	328
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	329	\begin{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	330	\item another difficulty is that the code is not allowed to contain \texttt{$\backslash$x00}:
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	331
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	332	\begin{center}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	333	\texttt{xorl \%eax, \%eax}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	334	\end{center}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	335	\end{itemize}\bigskip\bigskip
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	336
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	337	{\small
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	338	\lstinputlisting[language=C,numbers=none]{../progs/app5.c}}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	339
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	340	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	341	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	342
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	343	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	344	\begin{frame}[c]
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	345	\frametitle{Overflow.c}
222 81f9f0eb1180 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 221 diff changeset	346	\mbox{}\\[-10mm]
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	347
222 81f9f0eb1180 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 221 diff changeset	348	\small
81f9f0eb1180 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 221 diff changeset	349	\lstinputlisting[language=C,xleftmargin=-4mm,numbers=none]{../progs/overflow.c}
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	350
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	351
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	352	\end{frame}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	353	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	354
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	355	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	356	\begin{frame}[c]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	357	\frametitle{Optimising Success}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	358
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	359	\begin{center}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	360	\begin{tabular}{l@{\hspace{2cm}}l}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	361	\begin{tikzpicture}[scale=0.6]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	362	\draw[line width=1mm] (-2, -1) rectangle (2,3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	363	\draw[line width=1mm,fill=blue!30] (-2, 1.9) rectangle (2,3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	364	\draw (0,2.5) node {\small\tt shell code};
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	365	\draw[line width=1mm,fill=black] (0.3, -1) rectangle (2,-0.7);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	366	\draw[->,line width=0.3mm] (1.05, -1) -- (1.05,-1.7) --
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	367	(-3,-1.7) -- (-3, 3.7) -- (-1.9, 3.7) -- (-1.9, 3.1);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	368	\end{tikzpicture}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	369	&
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	370	\onslide<2>{
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	371	\begin{tikzpicture}[scale=0.6]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	372	\draw[gray!50,fill=red!30] (-2,0.3) rectangle (2,3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	373	\draw[line width=1mm] (-2, -1) rectangle (2,3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	374	\draw[line width=1mm,fill=blue!30] (-2, 0.3) rectangle (2, -0.7);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	375	\draw (0,-0.2) node {\small\tt shell code};
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	376	\draw[line width=1mm,fill=black] (0.3, -1) rectangle (2,-0.7);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	377	\draw [line width=0.5,decoration={brace,amplitude=2mm},decorate]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	378	(2.3,3) -- (2.3,0.3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	379	\draw[line width=0.3mm] (1.05, -1) -- (1.05,-1.7) --
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	380	(3,-1.7) -- (3,1.65) -- (2.6, 1.65);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	381	\end{tikzpicture}}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	382	\end{tabular}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	383	\end{center}\bigskip
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	384
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	385	\onslide<2>{
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	386	fill up the red part of the string with \pcode{NOP} operations
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	387	(Intel \texttt{$\backslash$x90})}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	388
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	389	\end{frame}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	390	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	391
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	392
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	393	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	394	\begin{frame}[c]
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	395	\frametitle{Variants}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	396
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	397	There are many variants:
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	398
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	399	\begin{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	400	\item return-to-lib-C attacks
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	401	\item heap-smashing attacks\\
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	402	\textcolor{gray}{\small(Slammer Worm in 2003 infected 90\% of vulnerable systems within 10 minutes)}\bigskip
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	403
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	404	\item ``zero-days-attacks'' (new unknown vulnerability)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	405	\end{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	406
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	407	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	408	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	409
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	410	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	411	\begin{frame}[c]
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	412	\frametitle{Format String Vulnerability}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	413
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	414	\small
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	415	\texttt{string} is nowhere used:\bigskip
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	416
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	417	{\footnotesize\lstinputlisting[language=C]{../progs/C4.c}}\bigskip
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	418
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	419	this vulnerability can be used to read out the stack
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	420
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	421	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	422	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	423
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	424	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	425	\begin{frame}[c]
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	426	\frametitle{\begin{tabular}{c}Protections against\\ Buffer Overflow Attacks\end{tabular}}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	427
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	428	\begin{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	429	\item use safe library functions
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	430	\item stack canaries
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	431	\item ensure stack data is not executable (can be defeated)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	432	\item address space randomisation (makes one-size-fits-all more difficult)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	433	\item choice of programming language (one of the selling points of Java)
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	434	\end{itemize}
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	435
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	436	\only<2>{
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	437	\begin{textblock}{7}(6,1)
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	438	\begin{bubble}[5cm]
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	439	\begin{tabular}{cp{2cm}}
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	440	\begin{tikzpicture}[baseline=40mm,scale=0.8]
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	441	%\draw[step=1cm] (-3,-1) grid (3,8);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	442	\draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	443	\draw[line width=1mm] (-1,-1.2) -- (-1,7.4);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	444	\draw[line width=1mm] ( 1,-1.2) -- ( 1,7.4);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	445	\draw (0,-1) node[anchor=south] {\tt main};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	446	\draw[line width=1mm] (-1,0) -- (1,0);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	447	\draw (0,0) node[anchor=south] {\tt arg$_3$=3};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	448	\draw[line width=1mm] (-1,1) -- (1,1);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	449	\draw (0,1) node[anchor=south] {\tt arg$_2$=2};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	450	\draw[line width=1mm] (-1,2) -- (1,2);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	451	\draw (0,2) node[anchor=south] {\tt arg$_1$=1};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	452	\draw[line width=1mm] (-1,3) -- (1,3);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	453	\draw (0,3.1) node[anchor=south] {\tt ret};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	454	\draw[line width=1mm] (-1,4) -- (1,4);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	455	\draw (0,4) node[anchor=south] {\small\tt last sp};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	456	\draw[line width=1mm] (-1,5) -- (1,5);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	457	\draw (0,5) node[anchor=south] {\tt\small\alert{\textbf{random}}};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	458	\draw[line width=1mm] (-1,6) -- (1,6);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	459	\draw (0,6) node[anchor=south] {\tt buf};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	460	\draw[line width=1mm] (-1,7) -- (1,7);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	461	\end{tikzpicture} &
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	462	canary: a random value after the local variables
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	463	\end{tabular}
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	464	\end{bubble}
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	465	\end{textblock}}
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	466
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	467
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	468	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	469	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	470
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	471	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	472	\begin{frame}[c]
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	473	\frametitle{NIST Statistics about BOA}
204 8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	474
8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	475	\begin{center}
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	476	\begin{tikzpicture}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	477	\begin{axis}[
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	478	xlabel={year},
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	479	ylabel={\% of total attacks},
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	480	ylabel style={yshift=0em},
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	481	enlargelimits=false,
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	482	xtick={1997,1999,2001,...,2015},
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	483	xmin=1996.5,
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	484	xmax=2016,
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	485	ymax=21,
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	486	ytick={0,5,...,20},
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	487	scaled ticks=false,
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	488	axis lines=left,
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	489	width=11cm,
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	490	height=5cm,
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	491	ybar,
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	492	nodes near coords=
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	493	{\footnotesize
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	494	$\pgfmathprintnumber[fixed,fixed zerofill,precision=1,use comma]{\pgfkeysvalueof{/data point/y}}$},
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	495	x tick label style={font=\footnotesize,/pgf/number format/1000 sep={}}]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	496	\addplot
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	497	table [x=Year,y=Percentage] {../handouts/bufferoverflows.data};
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	498	\end{axis}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	499	\end{tikzpicture}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	500	\end{center}
204 8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	501
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	502	from the US National Vulnerability Database\\
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	503	\small\url{http://web.nvd.nist.gov/view/vuln/statistics}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	504
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	505	\end{frame}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	506	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
204 8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	507
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	508	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	509	\begin{frame}[fragile]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	510	\frametitle{D-Link Wifi Router, BOA}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	511	\small
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	512
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	513	As a proof-of-concept, the following URL allows
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	514	attackers to control the return value saved on
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	515	the stack (the vulnerability is triggered when
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	516	executing \pcode{"/usr/sbin/widget"}):
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	517
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	518	\begin{center}\footnotesize
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	519	\pcode{curl http://<target ip>/post_login.xml?hash=AAA...AAABBBB}
204 8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	520	\end{center}
8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	521
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	522	The value of the "hash" HTTP GET parameter consists of
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	523	292 occurrences of the \pcode{'A'} character, followed by four
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	524	occurrences of character \pcode{'B'}. In our lab setup, characters
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	525	\pcode{'B'} overwrite the saved program counter (\pcode{\%ra}).\bigskip
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	526
3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	527
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	528	\begin{tabular}{@{}ll}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	529	Discovery date: & 06/03/2013\\
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	530	Release date: & 02/08/2013
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	531	\end{tabular}\bigskip
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	532
3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	533
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	534	\footnotesize
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	535	\hfill\url{http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	536	\end{frame}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	537	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	538
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	539	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	540	\begin{frame}[fragile]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	541	\frametitle{GHOST in Glibc}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	542
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	543	\small The GHOST vulnerability is a buffer overflow condition
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	544	that can be easily exploited locally and remotely. This
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	545	vulnerability is named after the GetHOSTbyname function
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	546	involved in the exploit.\medskip
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	547
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	548	The attack allows the attacker to execute arbitrary code and
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	549	take control of the victim’s vulnerable machine.
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	550	Unfortunately, the vulnerability exists in the GNU C Library
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	551	(glibc), a code library originally released in 2000, meaning
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	552	it has been widely distributed. Although an update released by
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	553	Linux in 2013 mitigated this vulnerability, most systems and
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	554	products have not installed the patch.\medskip
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	555
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	556
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	557	\begin{tabular}{@{}ll}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	558	Release date: & 01/28/2015
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	559	\end{tabular}\smallskip
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	560
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	561
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	562	\footnotesize
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	563	\hfill\url{https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	564	\end{frame}
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	565	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	566
3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	567
113 0332f8102121 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 112 diff changeset	568
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	569	\end{document}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	570
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	571	%%% Local Variables:
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	572	%%% mode: latex
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	573	%%% TeX-master: t
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	574	%%% End:
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	575

author	Christian Urban <christian dot urban at kcl dot ac dot uk>
	Mon, 05 Oct 2015 05:20:07 +0100
changeset 391	a612dd3ddc81
parent 381	036a762b02cf
child 392	4dff36e2bbc6
permissions	-rw-r--r--