In the past, I have managed to overflow my own vulnerable programs, and those of others, but only ever in a 32bit environment. Every time I try even a simple stack smash on a 64bit machine, I run into issues. An address I am trying to write always contains null bytes.
A simple example from a problem yesterday; I was trying to overwrite the GOT to cause a later call to
printf() to become a call to
system() I had all the addresses I needed (ASLR off, DEP on).
I became stuck when I tried to overwrite a stackland pointer (high memory address) with a heapland (low memory address) value.
0x7fffffff_ff480a90 -> 0x00000000_0068a9a0
My overflow ended with
\xa0\xa9\x68, which with the null terminator left the pointer looking like;
Which was no good, I looked at this for hours and couldn't figure a way around it. Like I say I have run into this null byte problem many times. I always thought it was just one of those things, but it seems to make it completely impossible to hack a 64bit system, as the addresses so often contain null bytes.
Am I just unlucky? Am I missing something obvious? I haven't heard anyone talking about this issue in terms of 32 vs 64.