hacktricks/binary-exploitation/integer-overflow.md

# Kuzidi kwa Nambari za Integer

<details>

<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>

Njia nyingine za kusaidia HackTricks:

- Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
- Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
- Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
- **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
- **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.

</details>

## Taarifa Msingi

Katikati ya **kuzidi kwa nambari za integer** kuna kikomo kilichowekwa na **ukubwa** wa aina za data katika programu ya kompyuta na **utafsiri** wa data.

Kwa mfano, **nambari isiyosaini ya biti 8** inaweza kuwakilisha thamani kutoka **0 hadi 255**. Ikiwa unajaribu kuhifadhi thamani 256 katika nambari isiyosaini ya biti 8, itazunguka hadi 0 kutokana na kikomo cha uwezo wake wa kuhifadhi. Vivyo hivyo, kwa **nambari isiyosaini ya biti 16**, ambayo inaweza kushikilia thamani kutoka **0 hadi 65,535**, kuongeza 1 hadi 65,535 kutazungusha thamani kurudi 0.

Zaidi ya hayo, **nambari iliyosainiwa ya biti 8** inaweza kuwakilisha thamani kutoka **-128 hadi 127**. Hii ni kwa sababu biti moja hutumiwa kuwakilisha ishara (chanya au hasi), ikibaki biti 7 kuwakilisha ukubwa. Nambari hasi zaidi inawakilishwa kama **-128** (binary `10000000`), na nambari chanya zaidi ni **127** (binary `01111111`).

### Thamani Kubwa

Kwa **maburuzi ya wavuti** yanaweza kuwa ya kuvutia kujua thamani kubwa zinazoungwa mkono:

{% tabs %}
{% tab title="Rust" %}
```rust
fn main() {

let mut quantity = 2147483647;

let (mul_result, _) = i32::overflowing_mul(32767, quantity);
let (add_result, _) = i32::overflowing_add(1, quantity);

println!("{}", mul_result);
println!("{}", add_result);
}
```
{% endtab %}

{% tab title="Swahili" %}
### Integer Overflow

Kuzidi kwa nambari ni hali ambapo thamani ya nambari inayohitajika kuhifadhiwa ni kubwa kuliko uwezo wa aina ya data inayotumiwa kuihifadhi. Hii inaweza kusababisha thamani kubwa kugeuka na kuwa thamani hasi au thamani ndogo kugeuka na kuwa thamani kubwa. Kwa mfano, katika C programming, kuzidi kwa nambari inaweza kusababisha udanganyifu wa kumbukumbu au uwezekano wa kutekelezwa kwa nambari ya hatari. Tahadhari inapaswa kuchukuliwa wakati wa kushughulikia operesheni za kuzidi kwa nambari ili kuzuia mashambulizi ya kimtandao. 
{% endtab %}
```c
#include <stdio.h>
#include <limits.h>

int main() {
int a = INT_MAX;
int b = 0;
int c = 0;

b = a * 100;
c = a + 1;

printf("%d\n", INT_MAX);
printf("%d\n", b);
printf("%d\n", c);
return 0;
}
```
## Mifano

### Kujaa kwa kiasi kikubwa

Matokeo yaliyochapishwa yatakuwa 0 kwa sababu tulijaza kwa kiasi kikubwa char:
```c
#include <stdio.h>

int main() {
unsigned char max = 255; // 8-bit unsigned integer
unsigned char result = max + 1;
printf("Result: %d\n", result); // Expected to overflow
return 0;
}
```
### Kubadilisha Kutoka Nambari Iliyosainiwa Kwenda Nambari Isiyosainiwa

Fikiria hali ambapo nambari iliyosainiwa inasomwa kutoka kwa mwingiliano wa mtumiaji na kisha kutumiwa katika muktadha ambao unaitumia kama nambari isiyosainiwa, bila ukaguzi sahihi:
```c
#include <stdio.h>

int main() {
int userInput; // Signed integer
printf("Enter a number: ");
scanf("%d", &userInput);

// Treating the signed input as unsigned without validation
unsigned int processedInput = (unsigned int)userInput;

// A condition that might not work as intended if userInput is negative
if (processedInput > 1000) {
printf("Processed Input is large: %u\n", processedInput);
} else {
printf("Processed Input is within range: %u\n", processedInput);
}

return 0;
}
```
Katika mfano huu, ikiwa mtumiaji anaingiza nambari hasi, itakuwa inachukuliwa kama nambari kubwa isiyosainiwa kutokana na jinsi thamani za binary zinavyochukuliwa, hivyo kusababisha tabia isiyotarajiwa.

### Mifano Mingine

* [https://guyinatuxedo.github.io/35-integer\_exploitation/int\_overflow\_post/index.html](https://guyinatuxedo.github.io/35-integer\_exploitation/int\_overflow\_post/index.html)
* Programu inathibitisha tu byte ya mwisho ya nambari ili kuhakiki ukubwa wa kuingia, hivyo ni rahisi kuongeza ukubwa wowote ikiwa tu byte ya mwisho iko ndani ya upeo ulioruhusiwa. Kisha, kuingia kunasababisha kujazwa kwa buffer lililodukuliwa na ret2win.
* [https://guyinatuxedo.github.io/35-integer\_exploitation/puzzle/index.html](https://guyinatuxedo.github.io/35-integer\_exploitation/puzzle/index.html)
* Kwa kupewa jozi ya nambari, tafuta kutumia z3 nambari mpya ambayo ikiongezwa na ya kwanza itatoa ya pili:&#x20;

```
(((argv[1] * 0x1064deadbeef4601) & 0xffffffffffffffff) == 0xD1038D2E07B42569)
```

\

<details>

<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Njia nyingine za kusaidia HackTricks:

* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
* Pata [**swagi rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.

</details>