The x86-64 CPU platform (i.e. AMD64 or Hammer) introduces new features to protect against exploitation of buffer overflows, the so called No Execute (NX) or Advanced Virus Protection (AVP). This non-executable enforcement of data pages and the ELF64 SystemV ABI render common buffer overflow exploitation techniques useless. This paper describes and analyzes the protection mechanisms in depth.

Research and target platform was a SUSE Linux 9.3 x86-64 system but the results can be expanded to non-Linux systems as well. search engine tag: SET-krahmer-bccet-2005. Preface Introduction ELF64 layout and x86-64 execution mode The borrowed code chunks technique And does this really work? Single write exploits Automated exploitation Related work Countermeasures Conclusion Credits

Download x86-64 Buffer Overflow Exploits and the Borrowed Code Chunks Exploitation Technique