Understanding Buffer Overflow: Stack and Heap Buffer Overflows, Exploiting Buffer Overflow, JOP and ROP

1. Understanding Buffer Overflow
1.1 Stack Buffer Overflows
a) Architecture of Stack OverFlow
Before Stack-Overflow

After Stack-Overflow
b) Program Execution
#include <stdio.h>
int main(int argc, char *argv[])
{
char buf[12];
memcpy(buf, argv[1], strlen(argv[1]));
printf(buf);
}
As stack grows from bottom to top, memory address decreases from high to low
 Buf size: 12 bytes
 Frame pointer 4 bytes
 Return address 4 bytes
 Arguments 4 bytes

1.2 Heap buffer overflow
a)

b) Testing Program
int main(int argc, char *argv[])
{
......
vulnerable(argv[1]);
return 0;
}
int vulnerable(char *buf)
{
HANDLE hp = HeapCreate(0, 0, 0);
HLOCAL chunk = HeapAlloc(hp, 0, 260);
strcpy(chunk, buf); ''' Vulnerability'''