# An In-Depth Survey of Bypassing Buffer Overflow Mitigation Techniques
## 1 Introduction
### Stack Based Buffer Overflow
#### 1.1.1 Process Stack  
In x86-64, the code section starts from 0x0400000 address, then we have the initialized and uninitialized data sections, above that we have the heap memory that is used for run time memory allocation. In architectures like x86-64 and MIPS the stack grows towards lower addresses ([PERSON] 1996) starting from 0x08000000000 and is used to hold function activation records [10]. Figure 2 shows the x86-64 Function Stack Frame (FSF), with register rbp and rsp pointing to the base and top of the active FSF respectively. For x86-64 running UNIX based OS, first six integer and six floating point arguments are passed via registers and the rest are pushed on the stack (if greater than six). For x86-64 running Microsoft Windows, first four integer arguments are passed via registers and the remaining are pushed on the stack (if greater than four). After the function arguments, the return address and contents of rbp register are pushed on the stack and then finally we have the space for local variables of that function. On x86-64 architecture, once the control is transferred to the callee, it performs procedure prolog which grows the process stack and creates the FSF, and the last two assembly instructions of the function are called procedure epilog which are responsible for unwinding the stack [10]. Figure 3 contains a basic C program that is compromised with BOF vulnerability and Figure 4 displays the structure of the copy_buff() function with the procedure prolog and epilog highlighted. A common occurrence across x86-64 and MIPS instructions sets and a wide range of programming languages is the use of FSF to store the return address during a procedure call that can easily be overridden by a BOF attack [11]. Therefore, changing the return address is the most common method of launching BOF attacks. The C and C++ programming languages are inherently unsafe and vulnerable to buffer overflow due to the fact that they don't provide low-level security measures, such as automatic bound-checking, and allow data and memory manipulation. There are numerous C library functions that are vulnerable to BOFs, including gets(), strcmp(), strcpy(), scanf(), and memcpy() [12]. This is shown in Figure 5, that illustrates writing additional bytes in the buffer of size 10 pictorially, thus causing a buffer overflow. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Software** & **Vulnerablity** & **Target** & **Year** & **Vulnerable Version** & **Patched Version** \\ \hline Acrobat and Adobe Reader & core application & Windows, Linux, Mac & 2005 & 5.0–7.0.2, 5.1–7.0.2 & 7.0.5 \\  & plug-in & OS, Solaris & & \\  & ASF Demuver & Windows, Mac OS X & 2013 & 2.0.5 & 2.0.6 \\  & & Web Server, websites, & 2014 & 1.0.1 & 1.0.1 g \\  & & email & & \\  & & GHOST & Red Hat Linux & 2015 & glibc-2.2 & glibc-2.7, 2.8 \\  & NVIDIA Tv & NVIDIA Tegra & & 2019 & Prior v8.0.1 & 8.0.1 \\  & & bootloader & & 2019 & 4.92.2 & 4.92.3 \\  & & & & Sudo 1.7–7.1–7.10p9, & \\  & & Linux / UNIX & 2021 & 1.8.2–1.8.31p2, & 1.8.32 \& 1.9.5p2 \\  & & & & 1.9.0–1.9.5p1 & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Most Prominent Buffer Overflow Vulnerabilities. attackers can exploit the BOF vulnerability by knowing the stack layout and overwriting the current FSF return address to a location containing malicious code. The attacker can gain complete access to the victim machine through a Code-injection attack that is used to inject malicious code into vulnerable application [13]. The injected code runs with that vulnerable application's privileges, and with sufficient privileges, the attacker can gain remote access to the host machine. Conventionally, the attacker uses the code injection technique to inject malicious code for getting a remote shell on the target system; therefore, these malicious codes are also called shellcodes. Figure 6 shows how a well-crafted string can be given as input to the program by the attacker, causing the code injection attack.