Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I'm trying to learn about heap overflows for this exploitation challenge I have to solve.
In short, the program allocates 3 consecutive buffers on the heap, and I have access to write whatever I want to all of them. Even though I write over the pointers used by the heap manager, which are located at the end of each buffer, no exception is raised when the buffers are HeapFree()d.
Why is that so? Shouldn't an exception be raised? How can I check on this further on?
thank you
AFAIR Windows XP does not necessarily crash on heap corruption, you need to specifically turn this behavior on using gflags.exe (from debugging tools)
gflags /p /full /enable foo.exe
Pageheap.exe might work as well, see http://support.microsoft.com/kb/286470
In any case, the point of exploitation is not to crash the process but to get it to run your code, so you don't need to worry why it does not crash.
