sen-material: slides/slides03.tex@da4896f201b5 (annotated)

28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	1	\documentclass[dvipsnames,14pt,t]{beamer}
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	2	\usepackage{../slides}
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	3	\usepackage{../graphics}
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	4	\usepackage{../langs}
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	5	\usepackage{../data}
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	6
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	7	\setmonofont[Scale=.88]{Consolas}
152 0c62ec6dc691 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 115 diff changeset	8	\newfontfamily{\consolas}{Consolas}
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	9
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	10	\hfuzz=220pt
111 677179c76e35 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 105 diff changeset	11
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	12	% beamer stuff
381 036a762b02cf updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 239 diff changeset	13	\renewcommand{\slidecaption}{SEN 03, King's College London}
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	14
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	15
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	16	\begin{document}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	17
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	18	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	19	\begin{frame}[t]
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	20	\frametitle{%
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	21	\begin{tabular}{@ {}c@ {}}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	22	\\
381 036a762b02cf updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 239 diff changeset	23	\LARGE Security Engineering (3)\\[-3mm]
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	24	\end{tabular}}\bigskip\bigskip\bigskip
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	25
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	26	\normalsize
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	27	\begin{center}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	28	\begin{tabular}{ll}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	29	Email: & christian.urban at kcl.ac.uk\\
111 677179c76e35 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 105 diff changeset	30	Office: & S1.27 (1st floor Strand Building)\\
105 40c51038c9e4 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 90 diff changeset	31	Slides: & KEATS (also home work is there)
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	32	\end{tabular}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	33	\end{center}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	34
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	35	\end{frame}
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	36	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	37
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	38	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	39	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	40	\frametitle{\Large Buffer Overflow Attacks}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	41
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	42	\begin{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	43	\begin{columns}[b]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	44	\begin{column}{.4\textwidth}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	45	\centering
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	46	\includegraphics[scale=0.3]{../pics/barrier.jpg}\\
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	47	lectures so far
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	48	\end{column}
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	49	\begin{column}{.4\textwidth}
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	50	\centering
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	51	\includegraphics[scale=0.32]{../pics/trainwreck.jpg}\\
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	52	today
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	53	\end{column}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	54	\end{columns}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	55	\end{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	56
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	57	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	58	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	59
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	60	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	61	\begin{frame}[c]
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	62	\frametitle{\begin{tabular}{@{}c@{}}According to\\ US Vulnerability DB\end{tabular}}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	63
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	64	\begin{center}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	65	\mbox{}\hspace{-8mm}\begin{tikzpicture}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	66	\begin{axis}[
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	67	xlabel={year},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	68	xlabel style={yshift=-1em},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	69	ylabel={\% of total attacks},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	70	ylabel style={yshift=-0em},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	71	enlargelimits=false,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	72	xtick={1997,2000,2002,...,2016},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	73	xmin=1996.5,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	74	xmax=2017,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	75	ymax=23,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	76	ytick={0,5,...,20},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	77	scaled ticks=false,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	78	axis lines=left,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	79	width=11.5cm,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	80	height=5cm,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	81	ybar,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	82	x tick label style={text height=1ex,font=\footnotesize,/pgf/number format/1000 sep={}},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	83	nodes near coords=
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	84	{\footnotesize
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	85	$\pgfmathprintnumber[fixed,fixed zerofill,precision=1,use comma]{\pgfkeysvalueof{/data point/y}}$}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	86	]
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	87	\addplot
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	88	table [x=Year,y=Percentage] {bufferoverflows.data};
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	89	\end{axis}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	90	\end{tikzpicture}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	91	\end{center}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	92
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	93
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	94	from the US National Vulnerability Database\\
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	95	\small\url{http://web.nvd.nist.gov/view/vuln/statistics}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	96	\end{frame}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	97	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	98
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	99
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	100	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	101	\begin{frame}[c]
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	102	\frametitle{Smash the Stack for Fun\ldots}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	103
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	104	\begin{itemize}
392 4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	105	\item \alert{\bf Buffer Overflow Attacks (BOAs)} or\\
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	106	{\bf Smashing the Stack Attacks}\medskip
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	107
392 4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	108	\item unfortunately one of the most popular attacks\\
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	109	($>$ 50\% of security incidents reported at CERT are related
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	110	to buffer overflows)
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	111	\begin{flushright}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	112	\small\url{http://www.kb.cert.org/vuls}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	113	\end{flushright}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	114	\medskip
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	115	\item made popular in an article from 1996 by Elias Levy
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	116	(also known as Aleph One):\\
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	117	\begin{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	118	{\bf ``Smashing The Stack For Fun and Profit''}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	119	\end{center}\medskip
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	120
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	121	\begin{flushright}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	122	\small\url{http://phrack.org/issues/49/14.html}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	123	\end{flushright}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	124
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	125	\end{itemize}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	126
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	127	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	128	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	129
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	130	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	131	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	132	\frametitle{A Long Printed ``Twice''}
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	133	\mbox{}\\[-6mm]
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	134
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	135	\footnotesize
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	136	\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C0.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	137
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	138	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	139	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	140
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	141	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	142	\begin{frame}[c]
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	143	\frametitle{Printing Out ``Zombies''}
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	144	\mbox{}\\[-6mm]
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	145
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	146	\footnotesize
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	147	\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C1.c}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	148
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	149	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	150	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	151
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	152	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	153	\begin{frame}[c]
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	154	\frametitle{A ``Login'' Function (1)}
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	155	\mbox{}\\[-6mm]
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	156
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	157	\footnotesize
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	158	\lstinputlisting[language=C,xleftmargin=4mm]{../progs/C2a.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	159
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	160	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	161	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	162
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	163	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	164	\begin{frame}[c]
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	165	\frametitle{A ``Login'' Function (2)}
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	166	\mbox{}\\[-6mm]
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	167
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	168	\footnotesize
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	169	\lstinputlisting[language=C,xleftmargin=-3mm]{../progs/C2b.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	170
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	171	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	172	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	173
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	174	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	175	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	176	\frametitle{What the Hell Is Going On?}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	177
216 38718062709a updated C2 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 211 diff changeset	178	\begin{itemize}
38718062709a updated C2 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 211 diff changeset	179	\item Let's start with a very simple program:
38718062709a updated C2 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 211 diff changeset	180	\end{itemize}
38718062709a updated C2 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 211 diff changeset	181
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	182	\lstinputlisting[language=C,xleftmargin=4mm]{../progs/example1.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	183
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	184	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	185	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	186
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	187	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	188	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	189	\frametitle{Memory}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	190
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	191	\begin{itemize}
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	192	\item each process will get a chunk of memory that is
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	193	organised as follows:
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	194	\end{itemize}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	195
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	196	\begin{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	197	\begin{tikzpicture}[scale=0.8]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	198	%\draw[step=1cm] (-3,-3) grid (3,3);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	199	\draw[line width=1mm] (-2, -3) rectangle (2,3);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	200	\draw[line width=1mm] (-2,1) -- (2,1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	201	\draw[line width=1mm] (-2,-1) -- (2,-1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	202	\draw (0,2) node {\large\tt text};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	203	\draw (0,0) node {\large\tt heap};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	204	\draw (0,-2) node {\large\tt stack};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	205
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	206	\draw (-2.7,3) node[anchor=north east] {\tt\begin{tabular}{@{}l@{}}lower\\ address\end{tabular}};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	207	\draw (-2.7,-3) node[anchor=south east] {\tt\begin{tabular}{@{}l@{}}higher\\ address\end{tabular}};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	208	\draw[->, line width=1mm] (-2.5,3) -- (-2.5,-3);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	209
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	210	\draw (2.7,-2) node[anchor=west] {\tt grows};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	211	\draw (2.7,-3) node[anchor=south west] {\tt\footnotesize older};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	212	\draw (2.7,-1) node[anchor=north west] {\tt\footnotesize newer};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	213	\draw[\|->, line width=1mm] (2.5,-3) -- (2.5,-1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	214	\end{tikzpicture}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	215	\end{center}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	216
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	217	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	218	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	219
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	220	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	221	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	222	\frametitle{The Stack}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	223
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	224	\begin{textblock}{7}(1,1)
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	225	\begin{tikzpicture}[scale=0.8]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	226	%\draw[step=1cm] (-3,-1) grid (3,8);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	227	\draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	228	\draw[line width=1mm] (-1,-1.2) -- (-1,7.4);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	229	\draw[line width=1mm] ( 1,-1.2) -- ( 1,7.4);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	230	\draw (0,-1) node[anchor=south] {\tt main};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	231	\draw[line width=1mm] (-1,0) -- (1,0);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	232	\draw (0,0) node[anchor=south] {\tt arg$_3$=3};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	233	\draw[line width=1mm] (-1,1) -- (1,1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	234	\draw (0,1) node[anchor=south] {\tt arg$_2$=2};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	235	\draw[line width=1mm] (-1,2) -- (1,2);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	236	\draw (0,2) node[anchor=south] {\tt arg$_1$=1};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	237	\draw[line width=1mm] (-1,3) -- (1,3);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	238	\draw (0,3.1) node[anchor=south] {\tt ret};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	239	\draw[line width=1mm] (-1,4) -- (1,4);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	240	\draw (0,4) node[anchor=south] {\small\tt last sp};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	241	\draw[line width=1mm] (-1,5) -- (1,5);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	242	\draw (0,5) node[anchor=south] {\tt buf$_1$};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	243	\draw[line width=1mm] (-1,6) -- (1,6);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	244	\draw (0,6) node[anchor=south] {\tt buf$_2$};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	245	\draw[line width=1mm] (-1,7) -- (1,7);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	246	\draw (2,6.1) node[anchor=south] {\code{$esp}};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	247	\draw[<-,line width=0.5mm] (1.1,7) -- (2.5,7);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	248
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	249	\draw[->,line width=0.5mm] (1,4.5) -- (1.8,4.5) -- (1.8, 0) -- (1.1,0);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	250	\draw[->,line width=0.5mm] (1,3.5) -- (2.5,3.5);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	251	\draw (2.6,3.1) node[anchor=south west] {\tt back to main()};
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	252
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	253	\draw[->,red,line width=2mm] (2.5,0.1) -- (4.2,0.1);
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	254	\end{tikzpicture}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	255	\end{textblock}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	256
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	257	\begin{textblock}{7}(6.4,8)
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	258	\begin{bubble}[6.8cm]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	259	\footnotesize
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	260	\lstinputlisting[language=C,xleftmargin=5mm]{../progs/example1.c}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	261	\end{bubble}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	262	\end{textblock}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	263
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	264	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	265	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	266
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	267	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	268	\begin{frame}[c]
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	269	\frametitle{Behind the Scenes}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	270
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	271	\only<2->{
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	272	\begin{textblock}{7}(1,0.6)
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	273	\begin{bubble}[6.8cm]
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	274	\footnotesize
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	275	\lstinputlisting[language=C,
2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	276	xleftmargin=5mm,
2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	277	belowskip=-1mm,
2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	278	aboveskip=-1mm]{../progs/example1.c}
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	279	\end{bubble}
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	280	\end{textblock}}
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	281
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	282	\only<2>{
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	283	\begin{textblock}{7}(0.5,6.6)
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	284	\footnotesize
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	285	\lstinputlisting[language={[x86masm]Assembler},morekeywords={movl},xleftmargin=5mm,numbers=none]{../progs/example1a.s}
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	286	\end{textblock}}
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	287
2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	288	\only<3>{
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	289	\begin{textblock}{7}(0.5,6.6)
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	290	\footnotesize
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	291	\lstinputlisting[language={[x86masm]Assembler},morekeywords={movl,movw},xleftmargin=5mm,numbers=none]{../progs/example1b.s}
223 2bc8309203c8 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 222 diff changeset	292	\end{textblock}}
211 e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	293
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	294	\end{frame}
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	295	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
e6e160c7ea33 added files Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 206 diff changeset	296
196 22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	297	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
22f027da67ec updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 152 diff changeset	298	\begin{frame}[c]
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	299	\frametitle{Overwriting the Stack}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	300
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	301	\begin{textblock}{7}(1,2)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	302	\begin{tikzpicture}[scale=0.8]
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	303	%\draw[step=1cm] (-3,-1) grid (3,8);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	304	\draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	305	\draw[line width=1mm] (-1,-1.2) -- (-1,6.4);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	306	\draw[line width=1mm] ( 1,-1.2) -- ( 1,6.4);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	307	\draw (0,-1) node[anchor=south] {\tt main};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	308	\draw[line width=1mm] (-1,0) -- (1,0);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	309	\draw (0,0) node[anchor=south] {\tt arg$_3$=3};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	310	\draw[line width=1mm] (-1,1) -- (1,1);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	311	\draw (0,1) node[anchor=south] {\tt arg$_2$=2};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	312	\draw[line width=1mm] (-1,2) -- (1,2);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	313	\draw (0,2) node[anchor=south] {\tt arg$_1$=1};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	314	\draw[line width=1mm] (-1,3) -- (1,3);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	315	\draw (0,3.1) node[anchor=south] {\tt ret};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	316	\draw[line width=1mm] (-1,4) -- (1,4);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	317	\draw (0,4) node[anchor=south] {\small\tt last sp};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	318	\draw[line width=1mm] (-1,5) -- (1,5);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	319	\draw (0,5) node[anchor=south] {\tt buf};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	320	\draw[line width=1mm] (-1,6) -- (1,6);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	321	\draw (2,5.1) node[anchor=south] {\code{$esp}};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	322	\draw[<-,line width=0.5mm] (1.1,6) -- (2.5,6);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	323
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	324	\draw[->,line width=0.5mm] (1,4.5) -- (1.8,4.5);
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	325	\draw (2.5,4.1) node[anchor=south] {\code{BBBB}};
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	326
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	327	\draw[->,line width=0.5mm] (1,3.5) -- (2.5,3.5);
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	328	\draw (2.6,3.1) node[anchor=south west] {\tt jump to \code{\\x080483f4}};
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	329	\end{tikzpicture}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	330	\end{textblock}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	331
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	332	\begin{textblock}{7}(1,13.5)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	333	\code{char buf[8] = "AAAAAAAABBBB\\xf4\\x83\\x04\\x08\\x00"}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	334	\end{textblock}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	335
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	336	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	337	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	338
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	339	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	340	\begin{frame}[c]
398 b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	341	\frametitle{C-Library Functions}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	342
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	343	\begin{itemize}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	344	\item copy everything up to the zero byte
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	345	\end{itemize}\medskip
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	346
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	347	{\small
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	348	\lstinputlisting[language=C,numbers=none]{../progs/app5.c}}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	349
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	350
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	351	\end{frame}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	352	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	353
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	354
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	355
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	356	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	357	\begin{frame}[c]
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	358	\frametitle{Payloads}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	359
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	360	\begin{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	361	\item the idea is that you store some code in the buffer (the payload)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	362	\item you then override the return address to execute this payload\medskip
398 b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	363	\item normally you want to start a shell\pause
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	364	\item difficulty is to guess the right place where to ``jump''
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	365	\end{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	366
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	367	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	368	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	369
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	370	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	371	\begin{frame}[t]
239 0db764174afb updated home works Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 226 diff changeset	372	\frametitle{Starting a Shell}
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	373
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	374	\small
400 f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	375	\lstinputlisting[language=C,numbers=none,xleftmargin=-6mm]{../progs/o2.c}
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	376
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	377	\begin{textblock}{7}(5,7.5)
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	378	\begin{bubble}[7cm]
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	379	\lstinputlisting[language=C,numbers=none,xleftmargin=-0mm]{../progs/shell.c}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	380	\end{bubble}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	381	\end{textblock}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	382
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	383	\end{frame}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	384	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	385
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	386	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	387	\begin{frame}[c]
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	388	\frametitle{Avoiding \texttt{$\backslash$x00}}
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	389
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	390	\begin{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	391	\item another difficulty is that the code is not allowed to contain \texttt{$\backslash$x00}:
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	392
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	393	\begin{center}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	394	\texttt{xorl \%eax, \%eax}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	395	\end{center}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	396	\end{itemize}\bigskip\bigskip
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	397
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	398	{\small
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	399	\lstinputlisting[language=C,numbers=none]{../progs/app5.c}}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	400
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	401	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	402	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	403
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	404	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
400 f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	405	\begin{frame}[t]
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	406	\frametitle{String from the Web}
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	407
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	408	{\small
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	409	\lstinputlisting[language=C,numbers=none,xleftmargin=-6mm]{../progs/o1.c}}
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	410	\bigskip\bigskip
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	411
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	412	\noindent
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	413	More ``interesting'' shell programs can be found at
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	414
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	415	\begin{center}
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	416	\url{http://shellblade.net/shellcode.html}
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	417	\end{center}
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	418
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	419	\end{frame}
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	420	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	421
f05368d007dd updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 398 diff changeset	422	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	423	\begin{frame}[c]
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	424	\frametitle{Overflow.c}
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	425	\mbox{}\\[-6mm]
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	426
222 81f9f0eb1180 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 221 diff changeset	427	\small
81f9f0eb1180 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 221 diff changeset	428	\lstinputlisting[language=C,xleftmargin=-4mm,numbers=none]{../progs/overflow.c}
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	429
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	430
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	431	\end{frame}
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	432	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	433
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	434	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	435	\begin{frame}[c]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	436	\frametitle{Optimising Success}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	437
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	438	\begin{center}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	439	\begin{tabular}{l@{\hspace{2cm}}l}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	440	\begin{tikzpicture}[scale=0.6]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	441	\draw[line width=1mm] (-2, -1) rectangle (2,3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	442	\draw[line width=1mm,fill=blue!30] (-2, 1.9) rectangle (2,3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	443	\draw (0,2.5) node {\small\tt shell code};
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	444	\draw[line width=1mm,fill=black] (0.3, -1) rectangle (2,-0.7);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	445	\draw[->,line width=0.3mm] (1.05, -1) -- (1.05,-1.7) --
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	446	(-3,-1.7) -- (-3, 3.7) -- (-1.9, 3.7) -- (-1.9, 3.1);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	447	\end{tikzpicture}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	448	&
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	449	\onslide<2>{
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	450	\begin{tikzpicture}[scale=0.6]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	451	\draw[gray!50,fill=red!30] (-2,0.3) rectangle (2,3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	452	\draw[line width=1mm] (-2, -1) rectangle (2,3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	453	\draw[line width=1mm,fill=blue!30] (-2, 0.3) rectangle (2, -0.7);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	454	\draw (0,-0.2) node {\small\tt shell code};
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	455	\draw[line width=1mm,fill=black] (0.3, -1) rectangle (2,-0.7);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	456	\draw [line width=0.5,decoration={brace,amplitude=2mm},decorate]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	457	(2.3,3) -- (2.3,0.3);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	458	\draw[line width=0.3mm] (1.05, -1) -- (1.05,-1.7) --
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	459	(3,-1.7) -- (3,1.65) -- (2.6, 1.65);
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	460	\end{tikzpicture}}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	461	\end{tabular}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	462	\end{center}\bigskip
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	463
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	464	\onslide<2>{
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	465	fill up the red part of the string with \pcode{NOP} operations
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	466	(Intel \texttt{$\backslash$x90})}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	467
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	468	\end{frame}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	469	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	470
398 b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	471	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	472	\begin{frame}[c]
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	473	\frametitle{Why BOAs Work?}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	474
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	475	\begin{itemize}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	476	\item stack grows from higher addresses to lower addresses
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	477	\item library functions copy memory until a zero-byte is
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	478	encountered
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	479	\end{itemize}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	480
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	481	\begin{center}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	482	\begin{tabular}{@{\hspace{-7mm}}c@{\hspace{2mm}}c@{}}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	483	\small
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	484	\begin{tikzpicture}[scale=0.45]
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	485	%\draw[step=1cm] (-3,-3) grid (3,3);
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	486	\draw[line width=1mm] (-2, -3) rectangle (2,3);
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	487	\draw[line width=1mm] (-2,1) -- (2,1);
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	488	\draw[line width=1mm] (-2,-1) -- (2,-1);
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	489	\draw (0,2) node {\tt text};
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	490	\draw (0,0) node {\tt heap};
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	491	\draw (0,-2) node {\tt stack};
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	492
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	493	\draw (-2.7,3) node[anchor=north east]
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	494	{\tt\begin{tabular}{@{}l@{}}lower\\ address\end{tabular}};
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	495	\draw (-2.7,-3) node[anchor=south east]
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	496	{\tt\begin{tabular}{@{}l@{}}higher\\ address\end{tabular}};
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	497	\draw[->, line width=1mm] (-2.5,3) -- (-2.5,-3);
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	498
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	499	\draw (2.7,-3) node[anchor=south west] {\tt\footnotesize older};
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	500	\draw (2.7,-1) node[anchor=north west] {\tt\footnotesize newer};
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	501	\draw[\|->, line width=1mm] (2.5,-3.09) -- (2.5,-1);
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	502	\end{tikzpicture}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	503	&
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	504	\raisebox{1.3cm}{\footnotesize
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	505	\lstinputlisting[language=C,numbers=none]{../progs/app5.c}}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	506	\end{tabular}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	507	\end{center}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	508
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	509	\end{frame}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	510	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
221 ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	511
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	512	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
ae6074cc446a updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 220 diff changeset	513	\begin{frame}[c]
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	514	\frametitle{Variants}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	515
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	516	There are many variants:
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	517
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	518	\begin{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	519	\item return-to-lib-C attacks
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	520	\item heap-smashing attacks\\
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	521	\textcolor{gray}{\small(Slammer Worm in 2003 infected 90\% of vulnerable systems within 10 minutes)}\bigskip
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	522
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	523	\item ``zero-days-attacks'' (new unknown vulnerability)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	524	\end{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	525
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	526	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	527	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	528
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	529	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	530	\begin{frame}[c]
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	531	\frametitle{\begin{tabular}{c}
2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	532	Protections against\\
2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	533	Buffer Overflow Attacks
2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	534	\end{tabular}}
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	535
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	536	\begin{itemize}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	537	\item use safe library functions
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	538	\item stack canaries
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	539	\item ensure stack data is not executable (can be defeated)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	540	\item address space randomisation (makes one-size-fits-all more difficult)
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	541	\item choice of programming language (one of the selling points of Java)
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	542	\end{itemize}
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	543
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	544	\only<2>{
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	545	\begin{textblock}{7}(6,1)
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	546	\begin{bubble}[5.5cm]
2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	547	\begin{tabular}{cp{2.9cm}}
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	548	\begin{tikzpicture}[baseline=40mm,scale=0.8]
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	549	%\draw[step=1cm] (-3,-1) grid (3,8);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	550	\draw[gray!20,fill=gray!20] (-1, 0) rectangle (1,-1);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	551	\draw[line width=1mm] (-1,-1.2) -- (-1,7.4);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	552	\draw[line width=1mm] ( 1,-1.2) -- ( 1,7.4);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	553	\draw (0,-1) node[anchor=south] {\tt main};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	554	\draw[line width=1mm] (-1,0) -- (1,0);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	555	\draw (0,0) node[anchor=south] {\tt arg$_3$=3};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	556	\draw[line width=1mm] (-1,1) -- (1,1);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	557	\draw (0,1) node[anchor=south] {\tt arg$_2$=2};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	558	\draw[line width=1mm] (-1,2) -- (1,2);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	559	\draw (0,2) node[anchor=south] {\tt arg$_1$=1};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	560	\draw[line width=1mm] (-1,3) -- (1,3);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	561	\draw (0,3.1) node[anchor=south] {\tt ret};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	562	\draw[line width=1mm] (-1,4) -- (1,4);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	563	\draw (0,4) node[anchor=south] {\small\tt last sp};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	564	\draw[line width=1mm] (-1,5) -- (1,5);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	565	\draw (0,5) node[anchor=south] {\tt\small\alert{\textbf{random}}};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	566	\draw[line width=1mm] (-1,6) -- (1,6);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	567	\draw (0,6) node[anchor=south] {\tt buf};
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	568	\draw[line width=1mm] (-1,7) -- (1,7);
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	569	\end{tikzpicture} &
396 2f4296a0ab21 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 392 diff changeset	570	\raggedright stack canary: a random value after the local variables
226 01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	571	\end{tabular}
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	572	\end{bubble}
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	573	\end{textblock}}
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	574
01fe5aba8781 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 223 diff changeset	575
220 74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	576	\end{frame}
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	577	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	578
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	579	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
74772c30e0f4 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 216 diff changeset	580	\begin{frame}[c]
398 b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	581	\frametitle{In my Examples I Cheated}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	582
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	583	I compiled the programs with
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	584
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	585	\begin{center}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	586	\begin{tabular}{l@{\hspace{1mm}}l}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	587	\pcode{/usr/bin/gcc} & \pcode{-ggdb -O0}\\
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	588	& \pcode{-fno-stack-protector}\\
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	589	& \pcode{-mpreferred-stack-boundary=2}\\
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	590	& \pcode{-z execstack}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	591	\end{tabular}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	592	\end{center}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	593
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	594	\end{frame}
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	595	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	596
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	597
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	598
b183036ba675 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 396 diff changeset	599	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	600	%% \begin{frame}[c]
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	601	%% \frametitle{NIST Statistics about BOA}
204 8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	602
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	603	%% \begin{center}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	604	%% \begin{tikzpicture}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	605	%% \begin{axis}[
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	606	%% xlabel={year},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	607	%% ylabel={\% of total attacks},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	608	%% ylabel style={yshift=0em},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	609	%% enlargelimits=false,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	610	%% xtick={1997,1999,2001,...,2015},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	611	%% xmin=1996.5,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	612	%% xmax=2016,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	613	%% ymax=21,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	614	%% ytick={0,5,...,20},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	615	%% scaled ticks=false,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	616	%% axis lines=left,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	617	%% width=11cm,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	618	%% height=5cm,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	619	%% ybar,
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	620	%% nodes near coords=
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	621	%% {\footnotesize
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	622	%% $\pgfmathprintnumber[fixed,fixed zerofill,precision=1,use comma]{\pgfkeysvalueof{/data point/y}}$},
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	623	%% x tick label style={font=\footnotesize,/pgf/number format/1000 sep={}}]
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	624	%% \addplot
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	625	%% table [x=Year,y=Percentage] {../handouts/bufferoverflows.data};
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	626	%% \end{axis}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	627	%% \end{tikzpicture}
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	628	%% \end{center}
204 8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	629
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	630	%% from the US National Vulnerability Database\\
da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	631	%% \small\url{http://web.nvd.nist.gov/view/vuln/statistics}
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	632
467 da4896f201b5 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 400 diff changeset	633	%% \end{frame}
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	634	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
204 8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	635
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	636	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	637	\begin{frame}[fragile]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	638	\frametitle{D-Link Wifi Router, BOA}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	639	\small
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	640
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	641	As a proof-of-concept, the following URL allows
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	642	attackers to control the return value saved on
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	643	the stack (the vulnerability is triggered when
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	644	executing \pcode{"/usr/sbin/widget"}):
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	645
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	646	\begin{center}\footnotesize
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	647	\pcode{curl http://<target ip>/post_login.xml?hash=AAA...AAABBBB}
204 8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	648	\end{center}
8fe0dc898c73 added example1 Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 199 diff changeset	649
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	650	The value of the "hash" HTTP GET parameter consists of
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	651	292 occurrences of the \pcode{'A'} character, followed by four
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	652	occurrences of character \pcode{'B'}. In our lab setup, characters
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	653	\pcode{'B'} overwrite the saved program counter (\pcode{\%ra}).\bigskip
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	654
3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	655
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	656	\begin{tabular}{@{}ll}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	657	Discovery date: & 06/03/2013\\
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	658	Release date: & 02/08/2013
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	659	\end{tabular}\bigskip
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	660
3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	661
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	662	\footnotesize
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	663	\hfill\url{http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	664	\end{frame}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	665	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	666
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	667	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	668	\begin{frame}[fragile]
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	669	\frametitle{GHOST in Glibc}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	670
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	671	\small The GHOST vulnerability is a buffer overflow condition
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	672	that can be easily exploited locally and remotely. This
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	673	vulnerability is named after the GetHOSTbyname function
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	674	involved in the exploit.\medskip
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	675
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	676	The attack allows the attacker to execute arbitrary code and
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	677	take control of the victim’s vulnerable machine.
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	678	Unfortunately, the vulnerability exists in the GNU C Library
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	679	(glibc), a code library originally released in 2000, meaning
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	680	it has been widely distributed. Although an update released by
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	681	Linux in 2013 mitigated this vulnerability, most systems and
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	682	products have not installed the patch.\medskip
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	683
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	684
391 a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	685	\begin{tabular}{@{}ll}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	686	Release date: & 01/28/2015
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	687	\end{tabular}\smallskip
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	688
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	689
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	690	\footnotesize
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	691	\hfill\url{https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability}
a612dd3ddc81 updated slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 381 diff changeset	692	\end{frame}
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	693	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	694
392 4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	695	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	696	\begin{frame}[c]
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	697	\frametitle{Format String Vulnerability}
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	698
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	699	\small
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	700	\texttt{string} is nowhere used:\bigskip
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	701
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	702	{\footnotesize\lstinputlisting[language=C]{../progs/C4.c}}\bigskip
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	703
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	704	this vulnerability can be used to read out the stack
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	705
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	706	\end{frame}
4dff36e2bbc6 updated Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 391 diff changeset	707	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
114 3822d91a4639 added slides Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 113 diff changeset	708
113 0332f8102121 added Christian Urban <christian dot urban at kcl dot ac dot uk> parents: 112 diff changeset	709
28 10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	710	\end{document}
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	711
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	712	%%% Local Variables:
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	713	%%% mode: latex
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	714	%%% TeX-master: t
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	715	%%% End:
10da75d5db5d pushed Christian Urban <urbanc@in.tum.de> parents: diff changeset	716

author	Christian Urban <christian dot urban at kcl dot ac dot uk>
	Tue, 04 Oct 2016 22:43:00 +0100
changeset 467	da4896f201b5
parent 400	f05368d007dd
child 471	97ab057cbd2e
permissions	-rw-r--r--