Windows Heap Exploitation (Win2KSP0 through WinXPS…….ppt

Windows Heap Exploitation(Win2KSP0 through WinXPSP2) Agenda “Practical” Windows heap internals How to exploit Win2K – WinXP SP1 heap overflows 3rd party (me ?) assessment of WinXP SP2 improvements How to exploit WinXP SP2 heap overflows Summary Windows Heap Internals Many heaps can coexist in one process (normally 2-3) Windows Heap Internals Important heap structures Windows Heap Internals Introduction to Free Lists 128 doubly-linked list of free chunks (from 8 bytes to 1024 bytes) Chunk size is table row index * 8 bytes Entry [0] is a variable sized free lists contains buffers of 1KB = size 512KB, sorted in ascending order Windows Heap Internals Lookaside Table Used for “fast” allocates and deallocates when available Starts empty 128 singly-linked lists of busy chunks (free but left marked as busy) Windows Heap Internals Why have lookasides at all? Speed! Singly-linked Used to quickly allocate or deallocate No coalescing (leads to fragmentation) So the lookaside lists “fill up” quickly (4 entries) Windows Heap Internals Basic chunk structure – 8 Bytes Windows Heap Internals Free chunk structure – 16 Bytes Windows Heap Internals Allocation algorithm (high level) If size = 512K, virtual memory is used (not on heap) If 1K, first check the Lookaside lists. If there is no free entries on the Lookaside, check the matching free list If = 1K or no matching entry was found, use the heap cache (not discussed in this presentation). If = 1K and no free entry in the heap cache, use FreeLists[0] (the variable sized free list) If still can’t find any free entry, extend heap as needed Windows Heap Internals Allocate algorithm – FreeLists[0] This is usually what happens for chunk sizes 1K FreeLists[0] is sorted from smallest to biggest Check if FreeLists[0]-Blink to see if it is big enough (the biggest block) Then return the smallest free entry from free list[0] to fulfill the request, like this: While (Entry-Size NeededSize) Entry = Entry-Flink Windows Heap Internals Allo