3

I'm analyzing a use-after-free bug in IDA Pro by hand. Basically, I control the content of an object (pointed by a register) and I want to force a write at an arbitrary address. For instance, I might find a mov [ebx], eax, where I can control both eax and ebx.

Is there a way to automate this task at least in part?

Here's a simple example. Let's say we control the data pointed by ecx and we have this code:

  mov eax, [ecx]
  test dword ptr [ecx+8], 8
  jz skip
  mov ebx, [ecx+4]
  mov [eax], ebx    <---- arbitrary write
skip:

As you can see, by choosing the values at [ecx], [ecx+4] and [ecx+8] carefully, we can perform an arbitrary write. In reality, the code is much more complex, so it's hard to keep track of what we control and find a suitable instruction.

2
  • Are you speaking about a ROP gadget or am I totally confused ? – perror Apr 14 '15 at 21:10
  • @perror No, it's not about ROP. The application frees an object by mistake and keep using it (through a dangling pointer). If you succeed in allocating some data you control at the same address where the freed object was, you can compromise the application. For instance, you can force the application to write 0x20 at a particular address which may modify the length of a javascript array so that you can now read beyond the real end of the array, etc... The problem is that you need to find an asm instruction that you can control. – Kiuhnm Apr 14 '15 at 22:40
5

I would agree with you in that you need to implement some kind of taint tracing, what is tricky statically. Moreover, you need to know whether there are any constraints applied to your controlled values. Also, we land in the symbolic execution domain (warning, there be dragons).

Anyway, maybe this project can be helpful to you. It even has IDA Pro integration in the latest version.

Good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.