Diffing, so sánh của một thư viện, chương trình, tập tin khác trước và sau khi một số hành động, là một trong những kỹ thuật hack đơn giản nhất. Nó được sử dụng thường xuyên trong quá trình nghiên cứu bảo mật, thường xuyên đến điểm rằng nó không phải là | Diffing Solutions in this chapter What Is Diffing Exploring Diffing Tools Troubleshooting 0 Summary 0 Solutions Fast Track 0 Frequently Asked Questions Chapter 5 131 132 Chapter 5 Diffing Introduction Diffing the comparison of a program library or other file before and after some action is one of the simplest hacking techniques. It is used frequently during security research often to the point that it is not thought of as a separate step. Diffing can be done at the disk file and database levels. At the disk level you can discover which files have been modified. At the file level you can discover which bytes have been changed. At the database level you can discover which records are different. By doing so you can discover how to manipulate the data outside of the application for which it is intended. What Is Diffing The diff utility predates many of the modern UNIX and UNIX-clone operating systems appearing originally in the UNIX implementation distributed by AT T and currently available in many variations on the original. The name diff is shorthand for difference derived from getting a list of the differences between two files. The term diffing can therefore be defined as the use of the diff utility or similar program to compare two files. From this comparison we can gather information for such purposes as determining what has changed from one revision of the software to the next whether or not a binary is different from another claiming to be the same or how a data file used by a program has changed from one operation to another. Examine the source code of the program shown in Figure . SYNGRESS Figure Source Code of Hal Flynn December 31 2001 demonstrates the problem with the strcpy function which is part of the c library. This program demonstrates strcpy not sufficiently checking input. When executed with an 8 byte argument a buffer overflow occurs. Continued Diffing Chapter 5 133 Figure .
