library/src/exploitation/BP-LinuxExploitation.cc
// Creates a stack to payload analysis
Creates a stack to payload analysis
Creates a stack to payload analysis
P_STACK_PAYLOAD_ANALYSIS DebugCreateStackPayloadAnalysis(P_DEBUG_HANDLE dbgHandle, char *payload, int payloadLength){
	if(dbgHandle == NULL)
		return NULL;
	if(payload == NULL)
		return NULL;
	if(payloadLength == 0)
		return NULL;
	P_STACK_PAYLOAD_ANALYSIS stackAnalysis  = NULL;
	GetMemMap(dbgHandle);
	DebugGetStackFromMapping(dbgHandle);
	DebugGetHeapFromMapping(dbgHandle);
			1). If the 4 byte values found above and below esp are found in
			     our payload, it is a likely indication of a stack overflow.  If in
				addition the value right above esp is in eip, we have an exploitable
				condition.
			2) If our buffer matches past the end of the valid stack top
	 			it is likely that we have a buffer overflow issue.
	 create heap analysis structure to hold calculation results
	stackAnalysis = (P_STACK_PAYLOAD_ANALYSIS) bpmalloc(sizeof(STACK_PAYLOAD_ANALYSIS));
		memset(stackAnalysis, 0x00, sizeof(STACK_PAYLOAD_ANALYSIS));
	void * firstStackOccurance = NULL;
	printf("\n -------------------------------------[+][+]");
	 look through heap for a minimum match of 16 bytes (memory intesive but reliable)
	for( firstStackOccurance = DebugSearchStack(dbgHandle, payload, 16, NULL);
			firstStackOccurance != NULL;
			firstStackOccurance = DebugSearchStack(dbgHandle, payload, 16, firstStackOccurance)){
		 1) Condition Implementation
		if(DebugCompareMemory(dbgHandle, firstStackOccurance, payload, payloadLength) == ERR_SUCCESS){
			if((size_t) firstStackOccurance > (size_t) dbgHandle->esp){
				stackAnalysis->completePayloadMatch = 1;
				stackAnalysis->matchIsLowerThanEsp = 1;
				break;
			} else {
				stackAnalysis->completePayloadMatch = 1;	
			}
		} else {
			 advance the stack pointer 4 bytes to allow for continued analysis
			firstStackOccurance = (void *)((size_t) firstStackOccurance + 16);
			 continue the loop till we find a 100% match, if no
			 match can be found, advanced algorithms will determine
			 exploitability.
			continue;
		}
		stackAnalysis->distanceToEip = ((size_t) dbgHandle->esp - 4) - (size_t) firstStackOccurance + 1;
		stackAnalysis->payloadAddr = (void *) firstStackOccurance;
		 compare stack layout		
		if(DebugCompareMemory(dbgHandle, (void *) (dbgHandle->esp-4), (char *) &dbgHandle->eip, 4) == ERR_SUCCESS){
			 now compare the value in eip to that of our offset in the provided payload
			if(DebugCompareMemory(dbgHandle, (void *) ((size_t) firstStackOccurance + stackAnalysis->distanceToEip), (char *) &dbgHandle->eip , 4) == ERR_SUCCESS){
				stackAnalysis->overflowConditionsGood = 1;
				stackAnalysis->spaceForShellcode = payloadLength - stackAnalysis->distanceToEip - 4;
			}	
		}
		 if we've gotten here, we know that we've calculated what we need
		return stackAnalysis;
	}
	 if we could not find an instance of our buffer starting at the top.
	 Try from the bottom (from $esp-4) on, this gives us an accurate
	 idea of if we are still in control of eip using our buffer.
	 matches need to be tried from the last byte of our payload
	 down from esp, for full matching.  If a match is made, try again
	 because if the match was very short, it could be matched again 
	 by the next 4 bytes plus our analyzed bytes
	 this method is used second in our list of tries because it is
	 simply more memory intensive then the first.
	int payloadCtr = 0;
	int compareEvaluation = 0;
	 There may be a bug here in calculating non 4 byte aligned values
	 so crazy
	while(DebugCompareMemory(dbgHandle, (void *) (dbgHandle->esp-4), (char *) &payload[payloadCtr] , payloadLength-payloadCtr) != ERR_SUCCESS){
		payloadCtr++;
		if(payloadCtr >= payloadLength){
			break;
		}
	}
	 esp + match has been made
	 program appears to be controllable
	if(payloadCtr < payloadLength){
		 payload ctr now equals our control offset
		 into eip.
		stackAnalysis->overflowConditionsGood = 1;
		size_t tempDistanceToEip = (payloadLength - payloadCtr);
		stackAnalysis->distanceToEip = payloadLength - tempDistanceToEip;
		 stackAnalysis->payloadAddr = (void *) (dbgHandle->esp - 4 - payloadCtr);		
		 this is dependent on the size of the payload most
		 of the time, if not enough space is there, perhaps
		 try it again with a longer overwrite buffer.
		stackAnalysis->spaceForShellcode = tempDistanceToEip;
		tempDistanceToEip = 0;
	}
	return stackAnalysis;
}
P_STACK_PAYLOAD_ANALYSIS DebugCreateStackPayloadAnalysis ( P_DEBUG_HANDLE dbgHandle , char * payload , int payloadLength ) { if ( dbgHandle == NULL ) return NULL ; if ( payload == NULL ) return NULL ; if ( payloadLength == 0 ) return NULL ; P_STACK_PAYLOAD_ANALYSIS stackAnalysis = NULL ; GetMemMap ( dbgHandle ) ; DebugGetStackFromMapping ( dbgHandle ) ; DebugGetHeapFromMapping ( dbgHandle ) ; stackAnalysis = ( P_STACK_PAYLOAD_ANALYSIS ) bpmalloc ( sizeof ( STACK_PAYLOAD_ANALYSIS ) ) ; memset ( stackAnalysis , 0x00 , sizeof ( STACK_PAYLOAD_ANALYSIS ) ) ; void * firstStackOccurance = NULL ; printf ( " \n " ) ; for ( firstStackOccurance = DebugSearchStack ( dbgHandle , payload , 16 , NULL ) ; firstStackOccurance != NULL ; firstStackOccurance = DebugSearchStack ( dbgHandle , payload , 16 , firstStackOccurance ) ) { if ( DebugCompareMemory ( dbgHandle , firstStackOccurance , payload , payloadLength ) == ERR_SUCCESS ) { if ( ( size_t ) firstStackOccurance > ( size_t ) dbgHandle -> esp ) { stackAnalysis -> completePayloadMatch = 1 ; stackAnalysis -> matchIsLowerThanEsp = 1 ; break ; } else { stackAnalysis -> completePayloadMatch = 1 ; } } else { firstStackOccurance = ( void * ) ( ( size_t ) firstStackOccurance + 16 ) ; continue ; } stackAnalysis -> distanceToEip = ( ( size_t ) dbgHandle -> esp - 4 ) - ( size_t ) firstStackOccurance + 1 ; stackAnalysis -> payloadAddr = ( void * ) firstStackOccurance ; if ( DebugCompareMemory ( dbgHandle , ( void * ) ( dbgHandle -> esp - 4 ) , ( char * ) & dbgHandle -> eip , 4 ) == ERR_SUCCESS ) { if ( DebugCompareMemory ( dbgHandle , ( void * ) ( ( size_t ) firstStackOccurance + stackAnalysis -> distanceToEip ) , ( char * ) & dbgHandle -> eip , 4 ) == ERR_SUCCESS ) { stackAnalysis -> overflowConditionsGood = 1 ; stackAnalysis -> spaceForShellcode = payloadLength - stackAnalysis -> distanceToEip - 4 ; } } return stackAnalysis ; } int payloadCtr = 0 ; int compareEvaluation = 0 ; while ( DebugCompareMemory ( dbgHandle , ( void * ) ( dbgHandle -> esp - 4 ) , ( char * ) & payload [ payloadCtr ] , payloadLength - payloadCtr ) != ERR_SUCCESS ) { payloadCtr ++ ; if ( payloadCtr >= payloadLength ) { break ; } } if ( payloadCtr < payloadLength ) { stackAnalysis -> overflowConditionsGood = 1 ; size_t tempDistanceToEip = ( payloadLength - payloadCtr ) ; stackAnalysis -> distanceToEip = payloadLength - tempDistanceToEip ; stackAnalysis -> spaceForShellcode = tempDistanceToEip ; tempDistanceToEip = 0 ; } return stackAnalysis ; }
Creates a stack to payload analysis
Creates a stack to payload analysis
// handle null checks // heap information // creating a first loop to search through the stack looking for our payload. // per each occurance of the payload matching a 16 byte alignment, a search is issued // into the container of the buffer.   // //		1). If the 4 byte values found above and below esp are found in //		     our payload, it is a likely indication of a stack overflow.  If in //			addition the value right above esp is in eip, we have an exploitable //			condition. // //		2) If our buffer matches past the end of the valid stack top // 			it is likely that we have a buffer overflow issue. //		 // create heap analysis structure to hold calculation results // look through heap for a minimum match of 16 bytes (memory intesive but reliable) // 1) Condition Implementation // advance the stack pointer 4 bytes to allow for continued analysis // continue the loop till we find a 100% match, if no // match can be found, advanced algorithms will determine // exploitability. // compare stack layout		 // now compare the value in eip to that of our offset in the provided payload // if we've gotten here, we know that we've calculated what we need // if we could not find an instance of our buffer starting at the top. // Try from the bottom (from $esp-4) on, this gives us an accurate // idea of if we are still in control of eip using our buffer. // matches need to be tried from the last byte of our payload // down from esp, for full matching.  If a match is made, try again // because if the match was very short, it could be matched again  // by the next 4 bytes plus our analyzed bytes // this method is used second in our list of tries because it is // simply more memory intensive then the first. // There may be a bug here in calculating non 4 byte aligned values // so crazy // esp + match has been made // program appears to be controllable // payload ctr now equals our control offset // into eip. // stackAnalysis->payloadAddr = (void *) (dbgHandle->esp - 4 - payloadCtr);		 // this is dependent on the size of the payload most // of the time, if not enough space is there, perhaps // try it again with a longer overwrite buffer.