THE USE OF “IMPLIED WARRANTY” AND CERTAIN “EXCLUSIONS” VARIES FROM STATE TO STATE, AND MAY NOT APPLY TO THE PURCHASER OF THIS PRODUCT. 10 Downer Avenue Hingham, Massachusetts 02043 781-740-0400 781-740-8816 (FAX) [email protected] book is printed on acid-free paper. Library of Congress Cataloging-in-Publication Data Thompson, Herbert H. For years, consumers have ignored the existence of software flaws, and the response to their existence by the IT industry has been the creation of defenses at the perimeter of the network. Michael Howard and Pete Krawczyk provided out- standing input and criticism as technical reviewers.Consider, for example, the following hexadecimal values: 6A0068B0FB110068D5FB11006A00FF1588204000 If these characters are interpreted as ASCII values (text), we have the following string: jh°ûhÕûjÿˆ @ If these characters are a part of an image, an audio file, an executable, or a data file, these values can be interpreted as almost anything.The reason our data is not immediately recognizable as something is that what it is depends on the context in which it’s interpreted.YOU FURTHER AGREE THAT THIS LICENSE GRANTS PERMISSION TO USE THE PRODUCTS CONTAINED HEREIN, BUT DOES NOT GIVE YOU RIGHT OF OWNERSHIP TO ANY OF THE CONTENT OR PRODUCT CONTAINED ON THIS CD-ROM. Matthew Oertle and Michael Cooper at SI Government Solutions helped us test the source code and sample tools we’ve provided.USE OF THIRD-PARTY SOFTWARE CONTAINED ON THIS CD-ROM IS LIMITED TO AND SUBJECT TO LICENSING TERMS FOR THE RESPECTIVE PRODUCTS. (“CRM”) AND/OR ANYONE WHO HAS BEEN INVOLVED IN THE WRITING, CREATION, OR PRODUCTION OF THE ACCOMPA- NYING CODE (“THE SOFTWARE”) OR THE THIRD-PARTY PRODUCTS CON- TAINED ON THE CD-ROM OR TEXTUAL MATERIAL IN THE BOOK, CANNOT AND DO NOT WARRANT THE PERFORMANCE OR RESULTS THAT MAY BE OBTAINED BY USING THE SOFTWARE OR CONTENTS OF THE BOOK. James Whittaker, author of How to Break Software and co-author of How to Break Software Security with Thompson, has been an inspiring teacher and mentor to us since our first project with him in 1998.A Call to Action 5 ANATOMY OF A SHELLCODE Our code from the first example is really a tiny program, sometimes called a shellcode, within the security community.
If the applications themselves cannot determine correct from incorrect input in some cases, how can an outside appliance?
The same holds true of many other add-on soft- ware protections that have the near impossible task of generically patching against flaws in software.