https://www.zoemurmure.top/zh/archives/2022/ Recent content in 2022 on Logic Security 逻辑门 Hugo -- gohugo.io zh Tue, 10 Jan 2023 15:09:38 +0800 https://www.zoemurmure.top/zh/posts/x64_paging/ Tue, 10 Jan 2023 15:09:38 +0800 https://www.zoemurmure.top/zh/posts/x64_paging/ 前言 在学习 HEVD 的过程中发现有很多知识不了解，这篇文章因此出现，文章内容翻译自参考资料^[1]^，出于学习目的考虑，内容和结构有所调整。 基本定义 https://www.zoemurmure.top/zh/posts/hevd_stackoberflowgs/ Tue, 10 Jan 2023 11:18:29 +0800 https://www.zoemurmure.top/zh/posts/hevd_stackoberflowgs/ 0. 前言 HackSys Extreme Vulnerable Driver (HEVD) 是出于学习内核的漏洞利用技巧而开发的具有多个漏洞的 Windows 驱动程序。本文介绍了 Windows 10 64 位环境下如何绕过带有 /GS 保护措施的栈溢出漏洞，涉 https://www.zoemurmure.top/zh/posts/hevd_stackoverflow/ Tue, 10 Jan 2023 11:18:24 +0800 https://www.zoemurmure.top/zh/posts/hevd_stackoverflow/ 目标函数 TriggerBufferOverflowStack __int64 __fastcall TriggerBufferOverflowStack(void *Src, unsigned __int64 Size) { char Dst[2048]; // [rsp+20h] [rbp-818h] BYREF memset(Dst, 0, sizeof(Dst)); ProbeForRead(Src, 0x800ui64, 1u); DbgPrintEx(0x4Du, 3u, "[+] UserBuffer: 0x%p\n", Src); DbgPrintEx(0x4Du, 3u, "[+] UserBuffer Size: 0x%X\n", Size); DbgPrintEx(0x4Du, 3u, "[+] KernelBuffer: 0x%p\n", Dst); DbgPrintEx(0x4Du, 3u, "[+] KernelBuffer Size: 0x%X\n", 0x800i64); DbgPrintEx(0x4Du, 3u, "[+] Triggering Buffer Overflow in Stack\n"); memmove(Dst, Src, Size); return 0i64; } 保护措施：