堆内存破坏检测实战.docx

堆内存破坏检测实战-附完整调试过程首先解释一下，什么是堆内存？堆是一种常见的内存管理器，应用程序通过堆来动态地分配和释放内存，通常使用堆的情况是无法预先知道所需要的内存大小，或者申请内存太大，无法通过栈内存来自动分配，下面让我们再来看一段英文解释。A heap is a form of memory manager that an application can use when it needs to allocateand free memory dynamically. Common situations that call for the use of a heapare when the size of the memory needed is not known ahead of time and the size ofthe memory is too large to neatly fit on the stack (automatic memory).常见的情况是由于效率或特殊需求一个进程中同时使用几个堆，如下图：下面通过一个完整的demo来带大家调试一个对破坏问题，demo代码如下：#define SZ_MAX_LEN 10void_cdeclwmain(intargc,WCHAR*args)if(argc=2)wprintf(LPressanykeytostartn);_getch();DupString(args1);elsewprintf(LPleaseenterastring);BOOLDupString(WCHAR*psz)BOOLbRet=FALSE;if(psz!=NULL)pszCopy=(WCHAR*)HeapAlloc(GetProcessHeap(),0,SZ_MAX_LEN*sizeof(WCHAR);if(pszCopy)wcscpy(pszCopy,psz);wprintf(LCopyofstring:%s,pszCopy);HeapFree(GetProcessHeap(),0,pszCopy);bRet=TRUE;returnbRet;在应用程序验证器下启用普通页堆，配置gflags,运行build出来的代码，输入参数为：SolidmangoSolidmangoSolidmango得到如下输出：CommandLine:C:WinXP.x86.chk06overrun.exeSolidmangoSolidmangoSolidmangoExecutablesearchpathis:ModLoad:010000000100500006overrun.exeModLoad:7c9000007c9b2000ntdll.dllAVRF:06overrun.exe:pid0x120C:flags0x8044B026:applicationverifierenabledModLoad:5ad100005ad59000C:WINDOWSSystem32verifier.dllModLoad:1000000010029000C:WINDOWSSystem32vrfcore.dllModLoad:003a0000003dc000C:WINDOWSSystem32vfbasics.dllModLoad:7c8000007c8f6000C:WINDOWSsystem32kernel32.dllAVRF:verifier.dllproviderinitializedfor06overrun.exewithflags0x8044B026ModLoad:77c1000077c68000C:WINDOWSsystem32msvcrt.dll(120c.1700):Breakinstructionexception-code80000003(firstchance)eax=00391ec4ebx=7ffd8000ecx=00000004edx=00000010esi=00391f98edi=00391ec4eip=7c90120eesp=0006fb20ebp=0006fc94iopl=0nvupeiplnznaponccs=001bss=0023ds=0023es=0023fs=003bgs=0000efl=00000202ntdll!DbgBreakPoint:7c90120eccint30:000g0:000g我们会看到一个访问违例,继续运行得到如下输出，说明应用程序验证器验证成功：=VERIFIERSTOP00000008:pid0x120C:Corruptedheapblock.00081000:Heaphandleusedinthecall.001E2B60:Heapblockinvolvedintheoperation.00000014:Sizeoftheheapblock.00000000:Reserved=Thisverifierstopisnotcontinuable.Processwillbeterminatedwhenyouusethegodebuggercommand.=(120c.1700):Breakinstructionexception-code80000003(firstchance)eax=1000e848ebx=1000cd44ecx=00000001edx=0006f939esi=00000000edi=1000e848eip=7c90120eesp=0006f9ccebp=0006fbd0iopl=0nvupeiplnznaponccs=001bss=0023ds=0023es=0023fs=003bgs=0000efl=00000202ntdll!DbgBreakPoint:7c90120eccint3继续调试，此时我们已经找到了出问题的堆快，注意观察上面的输出中有这样一条语句：001E2B60:Heapblockinvolvedintheoperation，好的，让我们看看这个堆块里面是什么东西，0:000dt_DPH_BLOCK_INFORMATION001E2B60-0x20ntdll!_DPH_BLOCK_INFORMATION+0x000StartStamp:0xabcdaaaa+0x004Heap:0x80081000Void+0x008RequestedSize:0x14+0x00cActualSize:0x3c+0x010FreeQueue:_LIST_ENTRY0x1e-0x0+0x010TraceIndex:0x1e+0x018StackTrace:0x00286c3cVoid+0x01cEndStamp:0xdcbaaaaa0:000dds0x00286c3c/callstack00286c3cabcdaaaa00286c400000000100286c440000000700286c480000000100286c4c0000001400286c500008100000286c540000000000286c5800286c5c00286c5c7c94b244ntdll!RtlAllocateHeapSlowly+0x4400286c607c919c0cntdll!RtlAllocateHeap+0xe6400286c64003afd2cvfbasics!AVrfpRtlAllocateHeap+0xb100286c68010012f406overrun!DupString+0x24c:awdchapter6overrunoverrun.cpp4100286c6c010012ab06overrun!wmain+0x2bc:awdchapter6overrunoverrun.cpp2800286c70010014b806overrun!_wmainCRTStartup+0x102d:vistartmbasecrtscrtw32dllstuffcrtexe.c71100286c747c817077kernel32!BaseProcessStart+0x2300286c7800000000我们找到了出问题的callstack:0:000kbChildEBPRetAddrArgstoChild0006f9c810003b6810062cb000000008001e2b60ntdll!DbgBreakPoint0006fbd0100078c91000c5400000000800081000vrfcore!VerifierStopMessageEx+0x4d10006fbf47c96c06e000000087c96c31400081000vrfcore!VfCoreRedirectedStopMessage+0x810006fc707c96d1470008100000000004001e2b60ntdll!RtlpDphReportCorruptedBlock+0x17c0006fc947c96d34a000810000100000200000010ntdll!RtlpDphNormalHeapFree+0x2e0006fce47c9703eb0008000001000002001e2b60ntdll!RtlpDebugPageHeapFree+0x790006fd587c94bafc0008000001000002001e2b60ntdll!RtlDebugFreeHeap+0x2c0006fe407c91a1ba0008000001000002001e2b60ntdll!RtlFreeHeapSlowly+0x370006ff10003afe9c0008000000000000001e2b60ntdll!RtlFreeHeap+0xf90006ff5801001340000800000000000000000014vfbasics!AVrfpRtlFreeHeap+0xf80006ff70010012ab00a646920006ffc0010014b806overrun!DupString+0x70c:awdchapter6overrunoverrun.cpp470006ff7c010014b80000000200a6464800a66e9806overrun!wmain+0x2bc:awdchapter6overrunoverrun.cpp280006ffc07c81707700daf6ee00daf7847ffd800006overrun!_wmainCRTStartup+0x102d:vistartmbasecrtscrtw32dllstuffcrtexe.c7110006fff000000000010015f60000000078746341kernel32!BaseProcessStart+0x230:000du00a6469200a64692SolidmangoSolidmangoSolidmango总结：原来是我们的参数破坏了了堆内存，终于找到了根源，我们代码中定义的堆的大小为10，而我们使用的时候，由于堆块越界，破坏了堆块的完整性，从而导致了crash的发生.注：本文的附图和代码灵感源自网络，具体出处不详，其他内容为原创.