| 发表于：2007-08-07 00:34:16 楼主 |
----------------------------
my $lstr='a'x200;
my $ostr='b'x100;
eax=7ffde000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c921230 esp=00b2ffcc ebp=00b2fff4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
*** error: symbol file could not be found. defaulted to export symbols for c:\w
indows\system32\ntdll.dll -
ntdll!dbgbreakpoint:
7c921230 cc int 3
0:006> g
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
access violation - code c0000005 （first chance)
eax=00000001 ebx=0003d450 ecx=014bf674 edx=7c92eb94 esi=0003d468 edi=00000000
eip=42424242 esp=014bf7c4 ebp=00000001 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
42424242 ?? ???
0:006> dd esp
014bf7c4 42424242 42424242 42424242 42424242
014bf7d4 42424242 42424242 42424242 42424242
014bf7e4 42424242 42424242 42424242 42424242
014bf7f4 42424242 42424242 42424242 00000000
014bf804 00000000 00000000 00000000 00000000
014bf814 00000000 00000000 00000000 00000000
014bf824 00000000 00000000 00000000 00000000
014bf834 00000000 00000000 00000000 00000000
0:006>
--------------
my $lstr='a'x200;
my $ostr='b'x28;
my $rstr='cdefg';
0:006> g
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
access violation - code c0000005 （first chance)
eax=00000001 ebx=0003d450 ecx=0143f674 edx=7c92eb94 esi=0003d468 edi=00000000
eip=47464544 esp=0143f7c4 ebp=00000001 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
47464544 ?? ???
0:006> dd esp
0143f7c4 0143fa40 00039b88 0143ff84 00e48028
--------------------------
my $lstr='a'x200;
my $ostr='b'x27;
my $rstr='cdd';
break instruction exception - code 80000003 （first chance)
eax=7ffdf000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c921230 esp=00b2ffcc ebp=00b2fff4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
*** error: symbol file could not be found. defaulted to export symbols for c:\w
indows\system32\ntdll.dll -
ntdll!dbgbreakpoint:
7c921230 cc int 3
0:006> g
access violation - code c0000005 （first chance)
eax=00000001 ebx=0003d450 ecx=0143f674 edx=7c92eb94 esi=0003d468 edi=00000000
eip=00004444 esp=0143f7c4 ebp=00000001 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
00004444 ?? ???
0:006>
-----------------------------
my $lstr='a'x200;
my $ostr='b'x27;
my $rstr='ced';
0:006> g
access violation - code c0000005 （first chance)
eax=00000001 ebx=0003d450 ecx=0143f674 edx=7c92eb94 esi=0003d468 edi=00000000
eip=00004445 esp=0143f7c4 ebp=00000001 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
00004445 ?? ???
0:006>
-------------------------
my $lstr='a'x200;
my $ostr='b'x40;
break instruction exception - code 80000003 （first chance)
eax=7ffde000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c921230 esp=00b2ffcc ebp=00b2fff4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
*** error: symbol file could not be found. defaulted to export symbols for c:\
indows\system32\ntdll.dll -
ntdll!dbgbreakpoint:
7c921230 cc int 3
0:006> g
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
access violation - code c0000005 （first chance)
eax=00000001 ebx=0003d450 ecx=0143f674 edx=7c92eb94 esi=0003d468 edi=00000000
eip=42424242 esp=0143f7c4 ebp=00000001 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
42424242 ?? ???
0:006> dd esp
0143f7c4 0143fa00 00039b88 0143ff84 00e47878
0143f7d4 00000000 00000000 00000000 00000000
0143f7e4 00000000 00000000 00000000 00000000
0143f7f4 00000000 00000000 00000000 00000000
0143f804 00000000 00000000 00000000 00000000
-------------------------
my $lstr='a'x200;
my $ostr='b'x60;
break instruction exception - code 80000003 （first chance)
eax=7ffd4000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c921230 esp=00b2ffcc ebp=00b2fff4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
*** error: symbol file could not be found. defaulted to export symbols for c:\w
indows\system32\ntdll.dll -
ntdll!dbgbreakpoint:
7c921230 cc int 3
0:006> g
c++ eh exception - code e06d7363 （first chance)
c++ eh exception - code e06d7363 （first chance)
access violation - code c0000005 （first chance)
eax=00000001 ebx=0003d450 ecx=0143f674 edx=7c92eb94 esi=0003d468 edi=00000000
eip=42424242 esp=0143f7c4 ebp=00000001 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
42424242 ?? ???
0:006> dd esp
0143f7c4 42424242 42424242 42424242 42424242
0143f7d4 42424242 00000000 00000000 00000000
0143f7e4 00000000 00000000 00000000 00000000
---------------
my $lstr='a'x200;
my $ostr='b'x41;
break instruction exception - code 80000003 （first chance)
eax=7ffdb000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c921230 esp=00b2ffcc ebp=00b2fff4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
*** error: symbol file could not be found. defaulted to export symbols for c:\w
indows\system32\ntdll.dll -
ntdll!dbgbreakpoint:
7c921230 cc int 3
0:006> g
c++ eh exception - code e06d7363 （first chance)
access violation - code c0000005 （first chance)
eax=00000001 ebx=0003d450 ecx=0153f674 edx=7c92eb94 esi=0003d468 edi=00000000
eip=42424242 esp=0153f7c4 ebp=00000001 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
42424242 ?? ???
0:007> dd esp
0153f7c4 01530042 00039b88 0153ff84 00e47c50
0153f7d4 00000000 00000000 00000000 00000000
0153f7e4 00000000 00000000 00000000 00000000
0153f7f4 00000000 00000000 00000000 00000000
--------------------------------------
以上是ntsd的调试信息.my $lstr='a'x200; my $ostr='b'x41;这些代表我用来定位溢出点的字符串.
大家帮忙看看能否找到溢出点,我这里还有一个很重要的问题就是,为什么同样长度的字符串,在尝试n次后才会出现溢出?而且这个n是不一定的,也就是没有规律.
大家看看到底是怎么会事? |
|
|
|
|
