04 November 2007

__dso_handle && __cxa_finalize()

So, I'm working on another program, not the one dealing with authentication and such but the one related to email with the buggy signal handler, there have been some complications in getting a reliable exploit for it so I backed up and thought maybe I could find something easier to exploit in the signal handler, I expected to perhaps be able to screw with OpenSSL in cleanup routines but there are none.

However, the code base is quite ugly and shows all the style of a grad student who thinks they know what they're doing and I decided to fix it to improve reliability (FYI spaces = bad, tabs = good, putting as many things as you can on a single line = bad, new lines = good [they come free with the computer]).

In doing so I found another small bug that I am trying to determine if I can leverage, basically there is a static array of signed chars that I have limited control over the index, because its signed I can provide a negative index, but I only have a single char for an index so I am limited to a max of -127 bytes before the array.

In that, I can do nothing if where the index ends up doesn't have the value of 0x20, so I started digging through .data (where the compiler puts the array) and seeing what has or could have a value of 0x20 -127 bytes back and I ran across a symbol named __dso_handle, not sure of what it is I dug into GCC a little bit and here's what I found.

Basically, it's a symbol that deals with C++ destructors for static objects in shared libraries, the relevant code that uses it is in a function called __cxa_finalize() and is something like as follows:

void
__cxa_finalize (void *d)
{
[...]

if (!d)
return;

for (funcs = __exit_funcs; funcs; funcs = funcs->next)
{
[...]

if (f->flavor == ef_cxa && d == f->func.cxa.dso_handle)
{
(*f->func.cxa.fn) (f->func.cxa.arg);
[...]
}
}
}




the argument 'd' is the __dso_handle for the shared object, interestingly enough if I could modify that then I would have the possibility of having another objects destructors called, causing any number of circumstances, most likely a double free().

It's not incredibly useful in this instance because I am dealing with a program that won't have any C++ static object destructors, but it's interesting none the less and something I will keep in mind in the future.

That's that, and that was today in my world. Good night.

18 comments:

products said...

China Wholesale has been described as the world’s factory. This phenomenom is typified by the rise ofbusiness. Incredible range of products available with China Wholesalers “Low Price and High Quality” not only reaches directly to their target clients worldwide but also ensures that wholesale from china from China means margins you cannot find elsewhere and buy products wholesaleChina Wholesale will skyroket your profits.wedding dressescheap naruto cosplayanime cosplaycheap Gemstone Jewelry

products said...

Women’s nike tn Shox Rivalry est le modèle féminin le plus tendance de baskets pour le sport. tn chaussuresConcernant la semelle :spyder jacketsCheap Brand Jeans Shop - True Religion Jeans cheap nike shox & Puma Shoes Online- tn nike,Diesel Jeans le caoutchouc extérieur, l’EVA intermédiaire Levis Jeanset le textile intérieur s’associent pour attribuer à la.ed hardy shirts pretty fitCharlestoncheap columbia jackets. turned a pair of double plays to do the trick.Lacoste Polo Shirts, puma basket, Burberry Polo Shirts.wholesale Lacoste polo shirts and cheap polo shirtswith great price.Thank you so much!!cheap polo shirts men'ssweate,gillette mach3 razor bladesfor men.As for Cheap Evisu JeansCheap Armani Jeanspolo shirtsPuma shoes

uwanna said...

gucci replica handbags
men gucci shoes
Gucci men sneakers
Gucci men moccasins
gucci women sneakers
gucci women boots
Gucci men boots
Gucci
Gucci shop
Gucci bags
Gucci shoes
Replica GUCCI SHOES
wholesale gucci shoes
cheap Gucci handbags
Gucci ON sale
Gucci Belts
Gucci small accessories
Gucci hats & scarves
Gucci wallets
Gucci Handbags
Women Gucci shoes
Men Gucci shoes
discount gucci shoes
cheap Gucci shoes

hxl said...

baby bedding
bed in a bag
sexual health
health plan
beauty cosmetics
skin care
health fitness sports
mens health
fashion shoes reviews
best air shoes
best women shoes
fashion dress
comfortable man shoes
fashion shoes
sneakers reviews
top ten boots
boots of world
rosetta stone
boots classic
wholesale lots
china wholesaler
china wholesale
wedding dress
lightinthebox reviews
fashion shoes

polo shirts said...

History of polo ralph lauren. Polo fashions had its humble beginnings in 1968 when tie salesman Ralph Lauren gave it a kick start. By 1969 he had a boutique polo ralph lauren factory stores within the Manhattan department store Bloomingdale's. ... Brands and luxury standard. Since Ralph Lauren's first brand, Polo Ralph Lauren, was launched, the company has expanded to include a variety of luxury brands such as Polo Golf, Polo Denim, Polo Sport. You can buy cheap Ralph Lauren Clothing at Ralph Lauren outlet.Also We provide polo shirts
Ralph Lauren polo shirt, 50% OFF! polo ralph lauren outlet online is your best choice!In 2006, polo ralph lauren outlet became the first designer in Wimbledon's 133-year history to create official uniforms for the tournament. As part of this year's event, which starts next week, polo ralph lauren sale will introduces the first ... determination to maintain and enhance the values for which our two brands are famous throughout the world. The rugby ralph lauren brand brings to Wimbledon the look of timeless elegance, drawing on our rich history and traditions

Herve Leger said...

Max Azria Herve Leger of Herve Leger from France, was founded in 1985, Paris is the famous fashion herve leger design house. Herve Leger dress to shaping the modern women, women have shown that line feels soft and the silhouette. Herve Leger clothing each place of body, to cut out the Christian Louboutin Pumps perfect bodily form female carved image and get the name "the bandage dress". Whether on the red carpet in Christian Louboutin attendance or Leger Herve party town of clothing for you to create unforgettable image.
In 1999, Paris dress GHD Styler design house by the Los Angeles fashion giant Herve Leger BCBG Azria Group owns, Max. This is the first time in history of French fashion brand by American herve leger bandage dress designer at the helm. Herve Leger in design and production of high-grade luxury and ready-to-wear uniforms. She and the perfect combination of Azria Max undoubtedly makes the Christian Louboutin Boots brand development in a new step. Max Azria Group determined BCBG Herve expand Leger of retail sales in New York, soon will appear on Madison avenue Herve four Hermes Leger boutiques. Soon, Beverly villa, the legendary Rue Paris Cambon, Las Vegas also have a shop.
In the summer of 2007, in order to meet the market demand growth, Leger released by Max Herve Azria cocktail dress design. Soon, the world and the garment Moncler wholesalers, will cooperate with Herve Leger garment around the world.
Since its establishment, from Herve Leger marked and sexy design style attracted numerous international customers worldwide, which is the most beautiful and the most ghd hair straighteners fashionable women. Hollywood star like Lindsay Lohan, article required, new Charlize Theron Zeta - a flop, and Beyonce, Christina Aguilera, Eva Mendes, Jackson, cernet operated language examiner "- Nicole Richie, Jessica Simpson, herve leger dresses Eva Longoria and Jessica Biel, Leger Herve became the most loyal fans. Herve Leger name forever and Hollywood's glittering and charm.

Herve Leger said...

Max Azria Herve Leger of Herve Leger from France, was founded in 1985, Paris is the famous fashion herve leger design house. Herve Leger dress to shaping the modern women, women have shown that line feels soft and the silhouette. Herve Leger clothing each place of body, to cut out the Christian Louboutin Pumps perfect bodily form female carved image and get the name "the bandage dress". Whether on the red carpet in Christian Louboutin attendance or Leger Herve party town of clothing for you to create unforgettable image.
In 1999, Paris dress GHD Styler design house by the Los Angeles fashion giant Herve Leger BCBG Azria Group owns, Max. This is the first time in history of French fashion brand by American herve leger bandage dress designer at the helm. Herve Leger in design and production of high-grade luxury and ready-to-wear uniforms. She and the perfect combination of Azria Max undoubtedly makes the Christian Louboutin Boots brand development in a new step. Max Azria Group determined BCBG Herve expand Leger of retail sales in New York, soon will appear on Madison avenue Herve four Hermes Leger boutiques. Soon, Beverly villa, the legendary Rue Paris Cambon, Las Vegas also have a shop.
In the summer of 2007, in order to meet the market demand growth, Leger released by Max Herve Azria cocktail dress design. Soon, the world and the garment Moncler wholesalers, will cooperate with Herve Leger garment around the world.
Since its establishment, from Herve Leger marked and sexy design style attracted numerous international customers worldwide, which is the most beautiful and the most ghd hair straighteners fashionable women. Hollywood star like Lindsay Lohan, article required, new Charlize Theron Zeta - a flop, and Beyonce, Christina Aguilera, Eva Mendes, Jackson, cernet operated language examiner "- Nicole Richie, Jessica Simpson, herve leger dresses Eva Longoria and Jessica Biel, Leger Herve became the most loyal fans. Herve Leger name forever and Hollywood's glittering and charm.

Herve Leger said...

Max Azria Herve Leger of Herve Leger from France, was founded in 1985, Paris is the famous fashion herve leger design house. Herve Leger dress to shaping the modern women, women have shown that line feels soft and the silhouette. Herve Leger clothing each place of body, to cut out the Christian Louboutin Pumps perfect bodily form female carved image and get the name "the bandage dress". Whether on the red carpet in Christian Louboutin attendance or Leger Herve party town of clothing for you to create unforgettable image.
In 1999, Paris dress GHD Styler design house by the Los Angeles fashion giant Herve Leger BCBG Azria Group owns, Max. This is the first time in history of French fashion brand by American herve leger bandage dress designer at the helm. Herve Leger in design and production of high-grade luxury and ready-to-wear uniforms. She and the perfect combination of Azria Max undoubtedly makes the Christian Louboutin Boots brand development in a new step. Max Azria Group determined BCBG Herve expand Leger of retail sales in New York, soon will appear on Madison avenue Herve four Hermes Leger boutiques. Soon, Beverly villa, the legendary Rue Paris Cambon, Las Vegas also have a shop.
In the summer of 2007, in order to meet the market demand growth, Leger released by Max Herve Azria cocktail dress design. Soon, the world and the garment Moncler wholesalers, will cooperate with Herve Leger garment around the world.
Since its establishment, from Herve Leger marked and sexy design style attracted numerous international customers worldwide, which is the most beautiful and the most ghd hair straighteners fashionable women. Hollywood star like Lindsay Lohan, article required, new Charlize Theron Zeta - a flop, and Beyonce, Christina Aguilera, Eva Mendes, Jackson, cernet operated language examiner "- Nicole Richie, Jessica Simpson, herve leger dresses Eva Longoria and Jessica Biel, Leger Herve became the most loyal fans. Herve Leger name forever and Hollywood's glittering and charm.

Herve Leger said...

Max Azria Herve Leger of Herve Leger from France, was founded in 1985, Paris is the famous fashion herve leger design house. Herve Leger dress to shaping the modern women, women have shown that line feels soft and the silhouette. Herve Leger clothing each place of body, to cut out the Christian Louboutin Pumps perfect bodily form female carved image and get the name "the bandage dress". Whether on the red carpet in Christian Louboutin attendance or Leger Herve party town of clothing for you to create unforgettable image.
In 1999, Paris dress GHD Styler design house by the Los Angeles fashion giant Herve Leger BCBG Azria Group owns, Max. This is the first time in history of French fashion brand by American herve leger bandage dress designer at the helm. Herve Leger in design and production of high-grade luxury and ready-to-wear uniforms. She and the perfect combination of Azria Max undoubtedly makes the Christian Louboutin Boots brand development in a new step. Max Azria Group determined BCBG Herve expand Leger of retail sales in New York, soon will appear on Madison avenue Herve four Hermes Leger boutiques. Soon, Beverly villa, the legendary Rue Paris Cambon, Las Vegas also have a shop.
In the summer of 2007, in order to meet the market demand growth, Leger released by Max Herve Azria cocktail dress design. Soon, the world and the garment Moncler wholesalers, will cooperate with Herve Leger garment around the world.
Since its establishment, from Herve Leger marked and sexy design style attracted numerous international customers worldwide, which is the most beautiful and the most ghd hair straighteners fashionable women. Hollywood star like Lindsay Lohan, article required, new Charlize Theron Zeta - a flop, and Beyonce, Christina Aguilera, Eva Mendes, Jackson, cernet operated language examiner "- Nicole Richie, Jessica Simpson, herve leger dresses Eva Longoria and Jessica Biel, Leger Herve became the most loyal fans. Herve Leger name forever and Hollywood's glittering and charm.

Herve Leger said...

Max Azria Herve Leger of Herve Leger from France, was founded in 1985, Paris is the famous fashion herve leger design house. Herve Leger dress to shaping the modern women, women have shown that line feels soft and the silhouette. Herve Leger clothing each place of body, to cut out the Christian Louboutin Pumps perfect bodily form female carved image and get the name "the bandage dress". Whether on the red carpet in Christian Louboutin attendance or Leger Herve party town of clothing for you to create unforgettable image.
In 1999, Paris dress GHD Styler design house by the Los Angeles fashion giant Herve Leger BCBG Azria Group owns, Max. This is the first time in history of French fashion brand by American herve leger bandage dress designer at the helm. Herve Leger in design and production of high-grade luxury and ready-to-wear uniforms. She and the perfect combination of Azria Max undoubtedly makes the Christian Louboutin Boots brand development in a new step. Max Azria Group determined BCBG Herve expand Leger of retail sales in New York, soon will appear on Madison avenue Herve four Hermes Leger boutiques. Soon, Beverly villa, the legendary Rue Paris Cambon, Las Vegas also have a shop.
In the summer of 2007, in order to meet the market demand growth, Leger released by Max Herve Azria cocktail dress design. Soon, the world and the garment Moncler wholesalers, will cooperate with Herve Leger garment around the world.
Since its establishment, from Herve Leger marked and sexy design style attracted numerous international customers worldwide, which is the most beautiful and the most ghd hair straighteners fashionable women. Hollywood star like Lindsay Lohan, article required, new Charlize Theron Zeta - a flop, and Beyonce, Christina Aguilera, Eva Mendes, Jackson, cernet operated language examiner "- Nicole Richie, Jessica Simpson, herve leger dresses Eva Longoria and Jessica Biel, Leger Herve became the most loyal fans. Herve Leger name forever and Hollywood's glittering and charm.

boshi said...

Third, Far away on the mysterious Isle of Zoobles reside hundreds of adorable, little creatures with a magnificent ability, they can magically transform into tiny balls hiding from the unknown, rolling to colorful destinations, sleeping after a long day But beware, you never know when these mischievous Zoobles are going to pop open and surprise you.

Fourth, EFX’s holographic technology contains algorithms and frequencies that interact positively with this energy field in both humans and animals at the cellular level. When placed near the body, especially at key energy centers such as the hands and feet, EFX bracelet’s products will harmonize with the body’s naturally occurring bioelectric frequencies.

Fifth, Every child wants a zhu zhu petshamster and we have all of them in stock as well as all the Zhu Zhu accesories for this most wished for of toys. They are also know as Go Go Pets or Go Go Hamsters in the UK and Europe. Enjoy your zhu zhu pets everyone. Sixth,
Pillow Pets is durability, machine washable, no batteries, friends for life and most important children like them. Silicone Watch is not only a fashional, but also healthy product, it is suitable to all people to wear.The designs are fashional and it can be worn whenever,whether you are sit or run. Wearing it, you will feel mental and muscle relax, besides.
barbie girls.

weddingdresses said...

The Power Balance bracelet is made of pure surgical grade silicone that is extremely durable. Its stretch feature optimizes users' comfort level. It comes equipped with two, visible power balance holograms and this sporty and stylish bracelet goes with everything.

Specification:

Silicone Power Balance Wristband Bracelet
The band made of 100% silicone rubber
With 2 visible hologram disks for balance power,waterproof.


Except for this product,customers are eager to shop for:

Silly Bandz
Moncler Jackets
Reebok Easytone

wild africa said...

Moncler Mens Jacket
Moncler Jackets Women
Moncler women jacket
Women moncler jackets
moncler bulgarie

Moncler Vanoise
Moncler Vanoise Jacket
Moncler Jackets For Men
Moncler Shirts
Moncler Gilet

Moncler Moka
Moncler Moka
Moncler Moka Coat
moncler women coat

Moncler Women Down
Moncler Claire
Mokacine,Mokacine Coat
Moncler Tulsa,Moncler Tulsa Jacket

wild africa said...

Moncler Mens Jacket
Moncler Jackets Women
Moncler women jacket
Women moncler jackets
moncler bulgarie

Moncler Vanoise
Moncler Vanoise Jacket
Moncler Jackets For Men
Moncler Shirts
Moncler Gilet

Moncler Moka
Moncler Moka
Moncler Moka Coat
moncler women coat

Moncler Women Down
Moncler Claire
Mokacine,Mokacine Coat
Moncler Tulsa,Moncler Tulsa Jacket

aiya said...

Office 2010
Microsoft Office 2010
Microsoft word
Office 2007
Microsoft Office
Microsoft Office 2007
Office 2007 key
Office 2007 download
Office 2007 Professional
Outlook 2010
Microsoft outlook
Microsoft outlook 2010
Windows 7

pandorasell said...

Silver pandora jewelry store comprises replacement atomic number 79 equally the metal by choice in that pandora jewelry website flavors manners. .925 alright superlative Ag Jewelry checks 92.5% complete silver pandora jewelry online and comprises assorted with extra debases to beef up them and abbreviate maculating pandora style jewelry coming through a hard-nosed alloy as pandora bracelet beads . The rise in metal prices, especially gold, have begun to alter pandora leather bracelet dashes. Designers are applying sterling pandora style bracelet a lot of today because of its gold pandora bracelet appeal and affordability. Designers care Jacques Louis pandora charm necklace David Yurman and those from pandora’s cause changed their focus and are making A-list assembles by .925 Fine Sterling pandora necklace charms Although Silver is affordable its price has quietly risen 300% inch the last 5 years and is astir across 50% pandora silver beads these class entirely. Many investment advisers* recommend a portion of your wealth be inward Ag and amber. Trend setters who comprised the first to begin wearing pandora necklace leather metal to match tatto last word and additional electric current styles as well do good along accepting pandora bracelet charms worth more than they paid for it.

qinbincai123 said...

The beauty of a woman must be seen in her kirefg88 eyes,
because that is the doorway to her heart the place where love resides.
kobe beats by dre
Beats Mixr
Diamond Tears headphones
monster beats
beats by dre
dre beats

Jerry Gene said...

I really like your writing style. Nice Post keep it up.

Asus - K53E-DS31 15.6" LED Notebook - Intel Core i3 i3-2350M 2.30 GHz - Mocha

Asus - 14" Notebook 4 GB Memory - 500 GB Hard Drive - Black (P43E-XH31)