library/src/exploitation/BP-LinuxExploitation.cc
// Creates a heap to payload analysis of the given
// debugging session.
Creates a heap to payload analysis of the given
debugging session.
Creates a heap to payload analysis of the given debugging session .
P_HEAP_PAYLOAD_ANALYSIS DebugCreateHeapPayloadAnalysis(P_DEBUG_HANDLE dbgHandle, char *payload, int payloadLength){
	if(dbgHandle == NULL)
		return NULL;
	if(payload == NULL)
		return NULL;
	if(payloadLength == 0)
		return NULL;
	P_HEAP_PAYLOAD_ANALYSIS heapAnalysis  = NULL;
	P_HEAP_CHUNK heapChunkFound               = NULL;
	P_PROCESS_HEAP heapFound                    = NULL;
			1). First it will directly attempt to match the buffer, which gives us our best case scenario.
				If the buffer is matched, we know that we control the entire heap from that occurance on.
			2) If it is not directly matched, see how far of a match we get on that occurance, if  the match is 
	 			less than 1 quarter of the entire payload, we have a partial match. Compare from the bottom of the
	 			payload down the heap, reverse matching.  See if we control the bottom of the heap overflow.
			3) If it is directly matched at the bottom, do we control the inband data and beyond with our payload?
	 			If it is, then we know we can write a moderately reliable heap overflow.
	 create heap analysis structure to hold calculation results
	heapAnalysis = (P_HEAP_PAYLOAD_ANALYSIS) bpmalloc(sizeof(HEAP_PAYLOAD_ANALYSIS));
		memset(heapAnalysis, 0x00, sizeof(HEAP_PAYLOAD_ANALYSIS));
	void * firstHeapOccurance = NULL;
	 look through heap for all occurances
	for( firstHeapOccurance = DebugSearchHeap(dbgHandle, payload, 16, NULL);
			firstHeapOccurance != NULL;
			firstHeapOccurance = DebugSearchHeap(dbgHandle, payload, 16, firstHeapOccurance)){
		 record these variables to perform accurate heap crawling
		heapChunkFound = DebugHeapPointerGetChunk(dbgHandle, firstHeapOccurance);
		heapFound          = DebugHeapPointerGetHeap(dbgHandle, firstHeapOccurance);
		 1) Condition Implementation
		if(DebugSearchHeap(dbgHandle, payload, payloadLength, firstHeapOccurance) == firstHeapOccurance){
			heapAnalysis->completePayloadMatch = 1;	
		}
		 mark if likely overflowed
		if(heapChunkFound->next->likelyOverflow > 0){
				heapAnalysis->controllingHeapNextOverflowed = 1;
		}
		 offset of the buffer match from the start of the chunk
		heapAnalysis->controllingHeapOffset = (size_t) firstHeapOccurance - (size_t) heapChunkFound->base;
		 calculate and set next valid arena types 
		size_t nextArena = ((size_t) firstHeapOccurance + (1024 * 1024) );
		nextArena = nextArena & 0xfff00000;
		heapAnalysis->nextValidArena = (void *) nextArena;
		 calculate and set the distance from our buffer occurance 
		 to our next heap arena. 
		size_t bytesToNext = (size_t) heapAnalysis->nextValidArena - (size_t) firstHeapOccurance;
		 distance in bytes to next arena
		heapAnalysis->distanceToNextArena = bytesToNext;
		 number of chunks required to write, as well as the space for the
		 remainder chunk.
		heapAnalysis->padChunksTillArena = bytesToNext / 1028;
		heapAnalysis->padChunksTillArenaRemainder = bytesToNext % 1028;
		 distance to the next chunk header (includes offset)
		heapAnalysis->distanceToNextChunk = (  ((size_t) heapChunkFound->base + (size_t) heapChunkFound->realSize - heapAnalysis->controllingHeapOffset) \
																-   ((size_t) firstHeapOccurance - heapAnalysis->controllingHeapOffset)  );
		 printf("\n First Occurance: %p", firstHeapOccurance);
		 printf("\n Next Chunk: %x", ((size_t) heapChunkFound->base + (size_t) heapChunkFound->realSize));
		 printf("\n Distance to next chunk: %x", heapAnalysis->distanceToNextChunk);
		 printf("\n Using Header Offset: %x", heapAnalysis->controllingHeapOffset);
		 printf("\n Next Arena: %p", heapAnalysis->nextValidArena);
		 printf("\n Number of 1028 byte chunks till next arena is found: %i", heapAnalysis->padChunksTillArena);
		 printf("\n Number of remainder bytes left over after padding: %i", heapAnalysis->padChunksTillArenaRemainder);
		break;
	}
	return heapAnalysis;
}
P_HEAP_PAYLOAD_ANALYSIS DebugCreateHeapPayloadAnalysis ( P_DEBUG_HANDLE dbgHandle , char * payload , int payloadLength ) { if ( dbgHandle == NULL ) return NULL ; if ( payload == NULL ) return NULL ; if ( payloadLength == 0 ) return NULL ; P_HEAP_PAYLOAD_ANALYSIS heapAnalysis = NULL ; P_HEAP_CHUNK heapChunkFound = NULL ; P_PROCESS_HEAP heapFound = NULL ; heapAnalysis = ( P_HEAP_PAYLOAD_ANALYSIS ) bpmalloc ( sizeof ( HEAP_PAYLOAD_ANALYSIS ) ) ; memset ( heapAnalysis , 0x00 , sizeof ( HEAP_PAYLOAD_ANALYSIS ) ) ; void * firstHeapOccurance = NULL ; for ( firstHeapOccurance = DebugSearchHeap ( dbgHandle , payload , 16 , NULL ) ; firstHeapOccurance != NULL ; firstHeapOccurance = DebugSearchHeap ( dbgHandle , payload , 16 , firstHeapOccurance ) ) { heapChunkFound = DebugHeapPointerGetChunk ( dbgHandle , firstHeapOccurance ) ; heapFound = DebugHeapPointerGetHeap ( dbgHandle , firstHeapOccurance ) ; if ( DebugSearchHeap ( dbgHandle , payload , payloadLength , firstHeapOccurance ) == firstHeapOccurance ) { heapAnalysis -> completePayloadMatch = 1 ; } if ( heapChunkFound -> next -> likelyOverflow > 0 ) { heapAnalysis -> controllingHeapNextOverflowed = 1 ; } heapAnalysis -> controllingHeapOffset = ( size_t ) firstHeapOccurance - ( size_t ) heapChunkFound -> base ; size_t nextArena = ( ( size_t ) firstHeapOccurance + ( 1024 * 1024 ) ) ; nextArena = nextArena & 0xfff00000 ; heapAnalysis -> nextValidArena = ( void * ) nextArena ; size_t bytesToNext = ( size_t ) heapAnalysis -> nextValidArena - ( size_t ) firstHeapOccurance ; heapAnalysis -> distanceToNextArena = bytesToNext ; heapAnalysis -> padChunksTillArena = bytesToNext / 1028 ; heapAnalysis -> padChunksTillArenaRemainder = bytesToNext % 1028 ; heapAnalysis -> distanceToNextChunk = ( ( ( size_t ) heapChunkFound -> base + ( size_t ) heapChunkFound -> realSize - heapAnalysis -> controllingHeapOffset ) - ( ( size_t ) firstHeapOccurance - heapAnalysis -> controllingHeapOffset ) ) ; break ; } return heapAnalysis ; }
Creates a heap to payload analysis of the given
debugging session.
Creates a heap to payload analysis of the given debugging session .
// handle null checks // heap information // creating a first loop to search through the heap llooking for our payload. // per each occurance of the payload matching a 16 byte alignment, a search is issued // into the container of the buffer.   // //		1). First it will directly attempt to match the buffer, which gives us our best case scenario. //			If the buffer is matched, we know that we control the entire heap from that occurance on. // //		2) If it is not directly matched, see how far of a match we get on that occurance, if  the match is  // 			less than 1 quarter of the entire payload, we have a partial match. Compare from the bottom of the // 			payload down the heap, reverse matching.  See if we control the bottom of the heap overflow. // //		3) If it is directly matched at the bottom, do we control the inband data and beyond with our payload? // 			If it is, then we know we can write a moderately reliable heap overflow. // create heap analysis structure to hold calculation results // look through heap for all occurances // record these variables to perform accurate heap crawling // 1) Condition Implementation // mark if likely overflowed // offset of the buffer match from the start of the chunk // calculate and set next valid arena types  // calculate and set the distance from our buffer occurance  // to our next heap arena.  // distance in bytes to next arena // number of chunks required to write, as well as the space for the // remainder chunk. // distance to the next chunk header (includes offset) // printf("\n First Occurance: %p", firstHeapOccurance); // printf("\n Next Chunk: %x", ((size_t) heapChunkFound->base + (size_t) heapChunkFound->realSize)); // printf("\n Distance to next chunk: %x", heapAnalysis->distanceToNextChunk); // printf("\n Using Header Offset: %x", heapAnalysis->controllingHeapOffset); // printf("\n Next Arena: %p", heapAnalysis->nextValidArena); // printf("\n Number of 1028 byte chunks till next arena is found: %i", heapAnalysis->padChunksTillArena); // printf("\n Number of remainder bytes left over after padding: %i", heapAnalysis->padChunksTillArenaRemainder);