• Home

  • Documents

  • Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray ...
47
ANATOMY OF AURORA Exploit Analysis

Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

Tags:

Embed Size (px)

Citation preview

Page 1: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

ANATOMY OF AURORAExploit Analysis

Page 2: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

Anatomy of the Talk

Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The Debugging The Demo The End

Page 3: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

Background

December ’09: China hacks Google Adobe vulnerabilities suspected at first

Page 4: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

Background

December ’09: China hacks Google Adobe vulnerabilities suspected at first Later, IE6 was identified as the culprit

Page 5: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

Background

December ’09: China hacks Google Adobe vulnerabilities suspected at first Later, IE6 was identified as the culprit Chinese hackers breached an internal auditing tool used by law

enforcement agencies to monitor emails in order to spy on human rights activists and others

Page 6: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

Background

December ’09: China hacks Google Adobe vulnerabilities suspected at first Later, IE6 was identified as the culprit Chinese hackers breached an internal auditing tool used by law

enforcement agencies to monitor emails in order to spy on human rights activists and others

Jan ’10: Google attacks China Threatens to stop censoring search results

Page 7: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

Background

December ’09: China hacks Google Adobe vulnerabilities suspected at first Later, IE6 was identified as the culprit Chinese hackers breached an internal auditing tool used by law

enforcement agencies to monitor emails in order to spy on human rights activists and others

Jan ’10: Google attacks China Threatens to stop censoring search results Reveals they hacked China back- black hats ftw!

Page 8: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

Background

December ’09: China hacks Google Adobe vulnerabilities suspected at first Later, IE6 was identified as the culprit Chinese hackers breached an internal auditing tool used by law

enforcement agencies to monitor emails in order to spy on human rights activists and others

Jan ’10: Google attacks China Threatens to stop censoring search results Reveals they hacked China back- black hats ftw! The world goes ape-shit

Page 9: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

Background

December ’09: China hacks Google Adobe vulnerabilities suspected at first Later, IE6 was identified as the culprit Chinese hackers breached an internal auditing tool used by law

enforcement agencies to monitor emails in order to spy on human rights activists and others

Jan ’10: Google attacks China Threatens to stop censoring search results Reveals they hacked China back- black hats ftw! The world goes ape-shit

Jan 14th

Exploit code released on the net

Page 10: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

“Operation Aurora”

Sophisticated, multitier attack1. Possible email forgery

Page 11: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

“Operation Aurora”

Sophisticated, multitier attack1. Possible email forgery2. 0-day IE6 exploit (CVE-2010-0249) *16% browser share

Page 12: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

“Operation Aurora”

Sophisticated, multitier attack1. Possible email forgery2. 0-day IE6 exploit (CVE-2010-0249) *16% browser share

3. Payload downloads and activates malware

Page 13: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

“Operation Aurora”

Sophisticated, multitier attack1. Possible email forgery2. 0-day IE6 exploit (CVE-2010-0249) *16% browser share

3. Payload downloads and activates malware4. Remote connection to attacker is established

Page 14: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

“Operation Aurora”

Sophisticated, multitier attack1. Possible email forgery2. 0-day IE6 exploit (CVE-2010-0249) *16% browser share

3. Payload downloads and activates malware4. Remote connection to attacker is established5. ???

Page 15: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

“Operation Aurora”

Sophisticated, multitier attack1. Possible email forgery2. 0-day IE6 exploit (CVE-2010-0249) *16% browser share

3. Payload downloads and activates malware4. Remote connection to attacker is established5. ???6. Profit

Page 16: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Heap

First, a little about memory User applications store dynamic data in

the heap

AVAILABLE HEAP

HEAP

Page 17: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Heap

First, a little about memory User applications store dynamic data in

the heap In windows, the heap extends until

address 0x7fffffff

HEAP

USEABLE HEAP

0x7fffffff

Page 18: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Heap

First, a little about memory User applications store dynamic data in

the heap In windows, the heap extends until

address 0x7fffffff As a program uses more memory, the useable

heap grows HEAP

USEABLE HEAP

Page 19: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Heap

First, a little about memory User applications store dynamic data in

the heap In windows, the heap extends until

address 0x7fffffff As a program uses more memory, the useable

heap grows The more the useable heap

grows, the more space we have to play with…

HEAP

USEABLE HEAP

Page 20: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Heap

First, a little about memory User applications store dynamic data in

the heap In windows, the heap extends until

address 0x7fffffff As a program uses more memory, the useable

heap grows The more the useable heap

grows, the more space we have to play with…

How can we exploit this?

HEAP

USEABLE HEAP

Page 21: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Heap Spray

Heap spray! Fills the heap up with garbage data +

shellcode (ie “sprays” data at the heap)HEAP

USEABLE HEAPINJECTED

INJECTEDINJECTEDINJECTED

Page 22: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Heap Spray

Heap spray! Fills the heap up with garbage data +

shellcode (ie “sprays” data at the heap) If we can get our program

to call or jump somewherein our injected heap, win!

HEAP

USEABLE HEAPINJECTED

INJECTEDINJECTEDINJECTED

jmp here plz kthx

Page 23: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Vulnerability

CVE-2010-0249 HTML Object Memory Corruption Vulnerability

“Use after free”

Page 24: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Vulnerability

CVE-2010-0249 HTML Object Memory Corruption Vulnerability

“Use after free” Remote code execution

Page 25: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Vulnerability

CVE-2010-0249 HTML Object Memory Corruption Vulnerability

“Use after free” Remote code execution Load an object, delete it, inject your code, call the object

Page 26: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Vulnerability

CVE-2010-0249 HTML Object Memory Corruption Vulnerability

“Use after free” Remote code execution Load an object, delete it, inject your code, call the object

In pictures!

Page 27: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Vulnerability

CVE-2010-0249 HTML Object Memory Corruption Vulnerability

“Use after free” Remote code execution Load an object, delete it, inject your code, call the object

In pictures!

USEABLE HEAP

Page 28: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Vulnerability

CVE-2010-0249 HTML Object Memory Corruption Vulnerability

“Use after free” Remote code execution Load an object, delete it, inject your code, call the object

In pictures!

USEABLE HEAP

OBJECT∙ Create an object

Page 29: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Vulnerability

CVE-2010-0249 HTML Object Memory Corruption Vulnerability

“Use after free” Remote code execution Load an object, delete it, inject your code, call the object

In pictures!

USEABLE HEAP

OBJECT∙ Create an object

Page 30: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Vulnerability

CVE-2010-0249 HTML Object Memory Corruption Vulnerability

“Use after free” Remote code execution Load an object, delete it, inject your code, call the object

In pictures!

USEABLE HEAP

∙ Delete object

The memory shouldn’t be useable again without being reallocated…

Page 31: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Vulnerability

CVE-2010-0249 HTML Object Memory Corruption Vulnerability

“Use after free” Remote code execution Load an object, delete it, inject your code, call the object

In pictures!

USEABLE HEAP

USEABLE SPACE∙ Delete object

The memory shouldn’t be useable again without being reallocated… but it is!

Page 32: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Exploit

5 Steps

Page 33: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Exploit

5 Steps1. Create space to overwrite our yet to

be created object with

Page 34: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Exploit

5 Steps1. Create space to overwrite our yet to

be created object with2. Spray the heap with nops and our

payload

Page 35: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Exploit

5 Steps1. Create space to overwrite our yet to

be created object with2. Spray the heap with nops and our

payload3. Load and dereference an image as our

object

Page 36: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Exploit

5 Steps1. Create space to overwrite our yet to

be created object with2. Spray the heap with nops and our

payload3. Load and dereference an image as our

object4. Inject a pointer to our malicious code

(step 2) inside the memory of our “image”

Page 37: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Exploit

5 Steps1. Create space to overwrite our yet to

be created object with2. Spray the heap with nops and our

payload3. Load and dereference an image as our

object4. Inject a pointer to our malicious code

(step 2) inside the memory of our “image”

5. Call the “image” again

Page 38: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Code

Page 39: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Debugging

We’ll load up the exploit with our shell code:

Page 40: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Debugging

We’ll load up the exploit with our shell code:

payload = unescape("%uccccSHELLCODE SHELLCODE");

Page 41: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Debugging

We’ll load up the exploit with our shell code:

payload = unescape("%uccccSHELLCODE SHELLCODE");

If it works, EIP (the next instruction to be executed), should now contain “SHELLCODE SHELLCODE”

Page 42: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Debugging

We’ll load up the exploit with our shell code:

payload = unescape("%uccccSHELLCODE SHELLCODE");

If it works, EIP (the next instruction to be executed), should now contain “SHELLCODE SHELLCODE”

Note: %ucccc == int 3, which is a debugging breakpoint

Page 43: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Demo

Inject shellcode to run calc.exe

Page 44: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Demo

Inject shellcode to run calc.exe

payload_calc = unescape("%uc92b%u1fb1%u0cbd%uc536%udb9b%ud9c5%u2474%u5af4%uea83%u31fc%u0b6a%u6a03%ud407%u6730%u5cff%u98bb%ud7ff%ua4fe%u9b74%uad05%u8b8b%u028d%ud893%ubccd%u35a2%u37b8%u4290%ua63a%u94e9%u9aa4%ud58d%ue5a3%u1f4c%ueb46%u4b8c%ud0ad%ua844%u524a%u3b81%ub80d%ud748%u4bd4%u6c46%u1392%u734a%u204f%uf86e%udc8e%ua207%u26b4%u04d4%ud084%uecba%u9782%u217c%ue8c0%uca8c%uf4a6%u4721%u0d2e%ua0b0%ucd2c%u00a8%ub05b%u43f4%u24e8%u7a9c%ubb85%u7dcb%ua07d%ued92%u09e1%u9631%u5580");

Page 45: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

The Demo

Inject shellcode to run calc.exe

payload_calc = unescape("%uc92b%u1fb1%u0cbd%uc536%udb9b%ud9c5%u2474%u5af4%uea83%u31fc%u0b6a%u6a03%ud407%u6730%u5cff%u98bb%ud7ff%ua4fe%u9b74%uad05%u8b8b%u028d%ud893%ubccd%u35a2%u37b8%u4290%ua63a%u94e9%u9aa4%ud58d%ue5a3%u1f4c%ueb46%u4b8c%ud0ad%ua844%u524a%u3b81%ub80d%ud748%u4bd4%u6c46%u1392%u734a%u204f%uf86e%udc8e%ua207%u26b4%u04d4%ud084%uecba%u9782%u217c%ue8c0%uca8c%uf4a6%u4721%u0d2e%ua0b0%ucd2c%u00a8%ub05b%u43f4%u24e8%u7a9c%ubb85%u7dcb%ua07d%ued92%u09e1%u9631%u5580");

Looks fancy, huh?

Page 46: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

THE ENDQuestions?

Page 47: Exploit Analysis. Anatomy of the Talk Background “Operation Aurora” The Heap The Heap Spray The Vulnerability The Exploit The Code The

References

General http://arstechnica.com/tech-policy/news/2010/01/google-and-china-the-attacks-and-their-aftermath.ars http://www.mcafee.com/us/threat_center/operation_aurora.html http://www.geoffchappell.com/notes/security/aurora/index.htm

In depth http://www.symantec.com/connect/blogs/trojanhydraq-incident-analysis-aurora-0-day-exploit http://www.sophos.com/blogs/duck/g/2010/01/20/aurora-exploit-live/

Code http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0249 http://www.exploit-db.com/exploits/11167 http

://blog.metasploit.com/2010/01/reproducing-aurora-ie-exploit.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+metasploit%2Fblog+%28Metasploit+Blog%29

http://wepawet.iseclab.org/view.php?hash=1aea206aa64ebeabb07237f1e2230d0f&type=js

Presentation http://www.calpolyswift.org/

Under “Presentations”

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0249
http://www.mcafee.com/us/threat_center/operation_aurora.html
http://www.mcafee.com/us/threat_center/operation_aurora.html
http://www.geoffchappell.com/notes/security/aurora/index.htm
http://www.geoffchappell.com/notes/security/aurora/index.htm
http://www.symantec.com/connect/blogs/trojanhydraq-incident-analysis-aurora-0-day-exploit
http://www.symantec.com/connect/blogs/trojanhydraq-incident-analysis-aurora-0-day-exploit
http://www.sophos.com/blogs/duck/g/2010/01/20/aurora-exploit-live/
http://www.sophos.com/blogs/duck/g/2010/01/20/aurora-exploit-live/
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0249
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0249
http://www.exploit-db.com/exploits/11167
http://www.exploit-db.com/exploits/11167
http://blog.metasploit.com/2010/01/reproducing-aurora-ie-exploit.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+metasploit/blog+(Metasploit+Blog)
http://blog.metasploit.com/2010/01/reproducing-aurora-ie-exploit.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+metasploit/blog+(Metasploit+Blog)
http://blog.metasploit.com/2010/01/reproducing-aurora-ie-exploit.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+metasploit/blog+(Metasploit+Blog)
http://wepawet.iseclab.org/view.php?hash=1aea206aa64ebeabb07237f1e2230d0f&type=js
http://wepawet.iseclab.org/view.php?hash=1aea206aa64ebeabb07237f1e2230d0f&type=js
http://wepawet.iseclab.org/view.php?hash=1aea206aa64ebeabb07237f1e2230d0f&type=js
http://www.calpolyswift.org/

Four different data structures, each one best in a different setting. Simple Heap Balanced Heap Fibonacci Heap Incremental Heap Our results

Four different data structures, each one best in a different setting. Simple Heap Balanced Heap Fibonacci Heap Incremental Heap Our results

Documents
Use-After-Use-After-Free Exploit UAF by Genrating Your Own · Advanced vulnerability exploitation ... Isolated Heap Mitigations MMgc. MMgc ByteArray & Vector AS3 Objects

Use-After-Use-After-Free Exploit UAF by Genrating Your Own · Advanced vulnerability exploitation ... Isolated Heap Mitigations MMgc. MMgc ByteArray & Vector AS3 Objects

Documents
Attacking the WebKit Heap

Attacking the WebKit Heap

Technology
More sorting algorithms: Heap sort & Radix sort. Heap Data Structure and Heap Sort (Chapter 7.6)

More sorting algorithms: Heap sort & Radix sort. Heap Data Structure and Heap Sort (Chapter 7.6)

Documents
Monthly Research History and Current State of Heap Exploit · memory region. • There are mainly 2 categories for memory corruption vulnerabilities. – Memory corruption on stack

Monthly Research History and Current State of Heap Exploit · memory region. • There are mainly 2 categories for memory corruption vulnerabilities. – Memory corruption on stack

Documents
Security and Privacy Technologiesshmat/courses/cs6431/memory-attacks.pdfmemory (stack or heap) •Intended to hold pre-defined amount of data •Simplest exploit: supply executable

Security and Privacy Technologiesshmat/courses/cs6431/memory-attacks.pdfmemory (stack or heap) •Intended to hold pre-defined amount of data •Simplest exploit: supply executable

Documents
1 Chapter 6 Heapsort. 2 About this lecture Introduce Heap Shape Property and Heap Property Heap Operations Heapsort: Use Heap to Sort Fixing heap

1 Chapter 6 Heapsort. 2 About this lecture Introduce Heap Shape Property and Heap Property Heap Operations Heapsort: Use Heap to Sort Fixing heap

Documents
S HEAP SIMON HEAP SIMON HEAP AGE: 21 EYE COLOR: … · 2017-01-18 · HEAP SIMON HEAP SIMON HEAP AGE: 21 EYE COLOR: Greenish-black HOME ADDRESS: The Observatory, the Badlands DISTINGUISHING

S HEAP SIMON HEAP SIMON HEAP AGE: 21 EYE COLOR: … · 2017-01-18 · HEAP SIMON HEAP SIMON HEAP AGE: 21 EYE COLOR: Greenish-black HOME ADDRESS: The Observatory, the Badlands DISTINGUISHING

Documents
The HEAP-MM proposal

The HEAP-MM proposal

Documents
MR201312 history and current state of heap exploit eng

MR201312 history and current state of heap exploit eng

Technology
Adobe Reader's Custom Memory Management · •Custom Heap Management may be faster, but lacks all the security mechanisms OS has •Empowers attackers with the capacity to exploit

Adobe Reader's Custom Memory Management · •Custom Heap Management may be faster, but lacks all the security mechanisms OS has •Empowers attackers with the capacity to exploit

Documents
Explore-Exploit Graph Traversal for Image Retrievalopenaccess.thecvf.com/content_CVPR_2019/papers/Chang_Explore-Exploit... · tween exploit and explore steps. The exploit step maxi-mally

Explore-Exploit Graph Traversal for Image Retrievalopenaccess.thecvf.com/content_CVPR_2019/papers/Chang_Explore-Exploit... · tween exploit and explore steps. The exploit step maxi-mally

Documents
Oracle Enterprise Manager 10g · The link Show Heap leads you to the Heap summary Page which breaks down the JVM heap usage by heap space and object type. The link Dump Heap to File

Oracle Enterprise Manager 10g · The link Show Heap leads you to the Heap summary Page which breaks down the JVM heap usage by heap space and object type. The link Dump Heap to File

Documents
On heap cache vs off-heap cache

On heap cache vs off-heap cache

Software
DieHarder : Securing the Heap

DieHarder : Securing the Heap

Documents
Windows Heap Overflows David Litchfield. Windows Heap Overflows Introduction This presentation will examine how to exploit heap based buffer overflows

Windows Heap Overflows David Litchfield. Windows Heap Overflows Introduction This presentation will examine how to exploit heap based buffer overflows

Documents
IEEE TRANSACTIONS ON DEPENDABLE AND SECURE … · and ChakraCore benchmarks. Index Terms—Heap, Exploit, Unaligned Access, Randomization, Allocator. F 1 INTRODUCTION Memory corruption

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE … · and ChakraCore benchmarks. Index Terms—Heap, Exploit, Unaligned Access, Randomization, Allocator. F 1 INTRODUCTION Memory corruption

Documents
Heap And Heap Sort

Heap And Heap Sort

Documents
Windows 8 Heap Internals final - Illmatics.comillmatics.com/Windows 8 Heap Internals (Slides).pdf · Windows 8 Heap Internals Why • Learn how the Heap Manager and Kernel Pool Allocator

Windows 8 Heap Internals final - Illmatics.comillmatics.com/Windows 8 Heap Internals (Slides).pdf · Windows 8 Heap Internals Why • Learn how the Heap Manager and Kernel Pool Allocator

Documents
Heap Off Memory WTF ?? Reducing Heap memory stress · PDF fileAbstract * Java memory fundamental * heap off memory principles * heap-off cache with Apache DirectMemory

Heap Off Memory WTF ?? Reducing Heap memory stress · PDF fileAbstract * Java memory fundamental * heap off memory principles * heap-off cache with Apache DirectMemory

Documents
Fibonacci Heap. p2. Procedure Binary heap (worst-case) Binomial heap (worst-case) Fibonacci heap (amortized) MAKE-HEAP (1) INSERT (lg n) O(lg n)

Fibonacci Heap. p2. Procedure Binary heap (worst-case) Binomial heap (worst-case) Fibonacci heap (amortized) MAKE-HEAP (1) INSERT (lg n) O(lg n)

Documents
The ADT Heap

The ADT Heap

Documents
The Binary Heap

The Binary Heap

Documents
C++ MEMORY MODEL DYNAMICMEMORY HEAP VS STACK · Deleting data on the Heap: delete To freememory on the heap use the deleteoperator p int p new int C2 delete P Hfrees the heap memory

C++ MEMORY MODEL DYNAMICMEMORY HEAP VS STACK · Deleting data on the Heap: delete To freememory on the heap use the deleteoperator p int p new int C2 delete P Hfrees the heap memory

Documents
Developments in IOS Forensics 2.0.10 export...Heap Reconstruction IOS uses one large heap The IOS heap contains plenty of meta-data for debugging purposes 40 bytes overhead per heap

Developments in IOS Forensics 2.0.10 export...Heap Reconstruction IOS uses one large heap The IOS heap contains plenty of meta-data for debugging purposes 40 bytes overhead per heap

Documents
A New CVE-2015-0057 Exploit Technology - Black Hat · PDF fileCVE-2015-0057 is a traditional Use-After-Free vulnerability, ... as heap Feng Shui ... A New CVE-2015-0057 Exploit Technology

A New CVE-2015-0057 Exploit Technology - Black Hat · PDF fileCVE-2015-0057 is a traditional Use-After-Free vulnerability, ... as heap Feng Shui ... A New CVE-2015-0057 Exploit Technology

Documents
Windows Exploit Mitigations · Randomized: Heap and Stack Not randomized: VirtualAlloc, MapViewOfFile A little randomized: PEBs, TEPBs Windows 8 Opt-in! (/dynamicbase) More things

Windows Exploit Mitigations · Randomized: Heap and Stack Not randomized: VirtualAlloc, MapViewOfFile A little randomized: PEBs, TEPBs Windows 8 Opt-in! (/dynamicbase) More things

Documents
mr me's IT security blog - Exploit Database · 2011-01-12 · 1 mr_me's IT security blog Exploiting, Reversing, Fuzzing, Code Analysis and Web Application Security Heap Overflows

mr me's IT security blog - Exploit Database · 2011-01-12 · 1 mr_me's IT security blog Exploiting, Reversing, Fuzzing, Code Analysis and Web Application Security Heap Overflows

Documents
Heap Models For Exploit Systems - openwall.info · I Heap allocator implementations are vastly di erent across Operating Systems. I Current research on heap shape analysis does not

Heap Models For Exploit Systems - openwall.info · I Heap allocator implementations are vastly di erent across Operating Systems. I Current research on heap shape analysis does not

Documents
Windows Kernel Internals User-mode Heap Manager Heap Stats 0:006> !heap -s The process has the following heap extended settings 00000008: - Low Fragmentation Heap activated for all

Windows Kernel Internals User-mode Heap Manager Heap Stats 0:006> !heap -s The process has the following heap extended settings 00000008: - Low Fragmentation Heap activated for all

Documents