5

I'm trying to learn about heap overflows for this exploitation challenge I have to solve.

In short, the program allocates 3 consecutive buffers on the heap, and I have access to write whatever I want to all of them. Even though I write over the pointers used by the heap manager, which are located at the end of each buffer, no exception is raised when the buffers are HeapFree()d.

Why is that so? Shouldn't an exception be raised? How can I check on this further on?

thank you

  • could you add some more information to your question, like platform/os (i get that it's windows, but which) , compiler used, source code ... – 0xea Sep 17 '13 at 19:36
  • haha so sorry. I'm running it on Windows XP SP3 with DEP disabled. I don't have the source code as I'm supposed to exploit the program. No idea which compile was used (can't tell from the strings). I'm using ollydbg for debugging - can this possibly be the reason no exception is being thrown? on the other hand, olly doesn't catch anything either. – user2835 Sep 17 '13 at 19:52
  • Tell us the program and the code you are sending towards it. By the text we can't see what you overwrite etc, etc. So long answer short: "More info required" Just saying: " area51.stackexchange.com/proposals/58554/exploit-development " – Stolas Sep 18 '13 at 6:56
7

AFAIR Windows XP does not necessarily crash on heap corruption, you need to specifically turn this behavior on using gflags.exe (from debugging tools)

gflags /p /full /enable foo.exe

Pageheap.exe might work as well, see http://support.microsoft.com/kb/286470

In any case, the point of exploitation is not to crash the process but to get it to run your code, so you don't need to worry why it does not crash.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.