library/src/exploitation/BP-LinuxExploitation.cc
// This creates an accurate exploit analysis, given a debugging handle
// if its signal was fatal, that signal is recorded.  Typically (6) IS
// a heap overflow, and 11 is a stack overflow or access violation.
This creates an accurate exploit analysis, given a debugging handle
if its signal was fatal, that signal is recorded.  Typically (6) IS
a heap overflow, and 11 is a stack overflow or access violation.
This creates an accurate exploit analysis given a debugging handle if its signal was fatal that signal is recorded . Typically ( 6 ) IS a heap overflow and 11 is a stack overflow or access violation .
P_EXPLOIT_ANALYSIS_LIST DebugCreateExploitAnalysis(P_DEBUG_HANDLE dbgHandle, char *payload, int payloadLength){
	if(dbgHandle == NULL)
		return NULL;
	if(dbgHandle->memory == NULL)
		return NULL;
	P_EXPLOIT_ANALYSIS_LIST exploitAnalysis = (P_EXPLOIT_ANALYSIS_LIST) bpmalloc(sizeof(EXPLOIT_ANALYSIS_LIST));
		memset(exploitAnalysis, 0x00, sizeof(EXPLOIT_ANALYSIS_LIST));
	if(dbgHandle->heap != NULL)
		exploitAnalysis->heapPayloadAnalysis = DebugCreateHeapPayloadAnalysis(dbgHandle, payload, payloadLength);
	if(exploitAnalysis->heapPayloadAnalysis != NULL){
		if(exploitAnalysis->heapPayloadAnalysis->controllingHeapNextOverflowed > 0){
			exploitAnalysis->exploiting = true;
			exploitAnalysis->exploitingInHeap = true;
		}
		if(exploitAnalysis->heapPayloadAnalysis->completePayloadMatch > 0){
			exploitAnalysis->exploiting = true;
			exploitAnalysis->exploitingInHeap = true;
		}
	}
	if(dbgHandle->stack != NULL)
		exploitAnalysis->stackPayloadAnalysis = DebugCreateStackPayloadAnalysis(dbgHandle, payload, payloadLength);
	if(exploitAnalysis->stackPayloadAnalysis != NULL){
		if(exploitAnalysis->stackPayloadAnalysis->completePayloadMatch > 0){
			exploitAnalysis->exploiting = true;
			exploitAnalysis->exploitingInHeap = true;
		}
		if(exploitAnalysis->stackPayloadAnalysis->matchIsLowerThanEsp < 1){
			exploitAnalysis->exploiting = true;
			exploitAnalysis->exploitingInHeap = true;
		}
	}
	return exploitAnalysis;
}
P_EXPLOIT_ANALYSIS_LIST DebugCreateExploitAnalysis ( P_DEBUG_HANDLE dbgHandle , char * payload , int payloadLength ) { if ( dbgHandle == NULL ) return NULL ; if ( dbgHandle -> memory == NULL ) return NULL ; P_EXPLOIT_ANALYSIS_LIST exploitAnalysis = ( P_EXPLOIT_ANALYSIS_LIST ) bpmalloc ( sizeof ( EXPLOIT_ANALYSIS_LIST ) ) ; memset ( exploitAnalysis , 0x00 , sizeof ( EXPLOIT_ANALYSIS_LIST ) ) ; if ( dbgHandle -> heap != NULL ) exploitAnalysis -> heapPayloadAnalysis = DebugCreateHeapPayloadAnalysis ( dbgHandle , payload , payloadLength ) ; if ( exploitAnalysis -> heapPayloadAnalysis != NULL ) { if ( exploitAnalysis -> heapPayloadAnalysis -> controllingHeapNextOverflowed > 0 ) { exploitAnalysis -> exploiting = true ; exploitAnalysis -> exploitingInHeap = true ; } if ( exploitAnalysis -> heapPayloadAnalysis -> completePayloadMatch > 0 ) { exploitAnalysis -> exploiting = true ; exploitAnalysis -> exploitingInHeap = true ; } } if ( dbgHandle -> stack != NULL ) exploitAnalysis -> stackPayloadAnalysis = DebugCreateStackPayloadAnalysis ( dbgHandle , payload , payloadLength ) ; if ( exploitAnalysis -> stackPayloadAnalysis != NULL ) { if ( exploitAnalysis -> stackPayloadAnalysis -> completePayloadMatch > 0 ) { exploitAnalysis -> exploiting = true ; exploitAnalysis -> exploitingInHeap = true ; } if ( exploitAnalysis -> stackPayloadAnalysis -> matchIsLowerThanEsp < 1 ) { exploitAnalysis -> exploiting = true ; exploitAnalysis -> exploitingInHeap = true ; } } return exploitAnalysis ; }
This creates an accurate exploit analysis, given a debugging handle
if its signal was fatal, that signal is recorded.
This creates an accurate exploit analysis given a debugging handle if its signal was fatal that signal is recorded .
// Exploit analysis structure // perform heap payload analysis // Determine if there was a heap corruption, if so mark heap exploitable // perform stack payload analysis 	 // Determine if there was a stack corruption, if so mark stack exploitable // most likesly if we have a complete match in the stack, we're looking // good. // cant be lower then esp to be a stack overflow on intel // registers are taken directly from debug pointer and should always be there //DebugCreateRegisterAnalysis(dbgHandle, payload, payloadLength);