Re: static char overflow

From: Shaun Clowes (shaunat_private)
Date: Sat May 04 2002 - 00:24:40 PDT

  • Next message: Shaun Clowes: "Re: BACKSTEALTH reverse engineered"

    >This has to be the case, since .dtors is always initialized. Initialized
    >data cannot be put after the end of p_filesz within that segment.
    >
    >Mhh... if one is very odd he can construct a valid ELF file with three
    >segments that has the .dtors section after the .bss section in memory, but
    >no linker will do that on its own ;)
    
    Incidentally this is one of the worst and best features of ELF, the 
    specification is very flexible and valid ELF files can be constructed in 
    all sorts of ways but the ELF loaders usually only cater for the simplest. 
    While an executable could easily be created with any number of 'bss' 
    sections at the end of segments it wouldn't actually work on some operating 
    systems, in particular the Linux ELF loader (in all the versions I've seen) 
    allows only one bss which must be at the end of the address space mapped in 
    the segments, if you create a segment following a segment with a bss on the 
    end the bss space is not actually allocated and accesses on it will segfault.
    
    Cheers,
    Shaun
    



    This archive was generated by hypermail 2b30 : Sat May 04 2002 - 10:47:14 PDT