Tag Info

New answers tagged

12

You've run into the hardest part of exploiting a buffer overflow: determining how to get the code to execute. Injecting code is trivial once you've found the vulnerability, but getting the CPU to start executing that code, not so much. Without a strong understanding of stack frame layout, you will find the rest difficult to follow. One point of note is ...


0

As you have already identified you will need to return to address 0x400631. When you smash the stack with your argument you should control EIP. Ie: ./a.out AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA You should see EIP of 0x41414141. Now you need to determine where in your stack of A's the 4 bytes that becomes EIP are ...


-1

while I do not agree with your plan, the way to skip an instruction is to modify the callers' pc register value, that is saved on the called functions' stack So skipping one instruction is rather simple, because instruction size (in modern CPUs) is relatively consistent. However skipping a line of C code is a whole different problem because the line ...


1

A canary value chosen at compile-time is constant from run to run, across all copies of the program. This means an attacker can figure it out by analyzing the program; once they know it, they can set up their overflow attack so that the overflow over-writes the canary with the same value it had originally, making the attack undetectable. If the canary ...


4

Buffer overflows aren't detected at compile time. There are code analysis tools such as Sparse or Lint (cpplint, pc-lint) that will perform further analysis on both source code files or compiled binaries. Each analysis tool has their own algorithms for determining a buffer overflow, but it comes down to common known instructions that lead to buffer ...


1

Consider the following code void f() { char buf[20]; strcpy(buf,"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); // The buffer overrun } void g() { .... f(); (address of this place will be pushed onto to the stack as the return address before calling f) ... } When g calls f, by default, the return address (i.e. address where ...



Top 50 recent answers are included