Tag Info

New answers tagged

1

I wrote that exact code into an overflow.c file, and got the following main(). I disassembled with objdump --disassemble overflow 0804846d <main>: 804846d: 55 push %ebp 804846e: 89 e5 mov %esp,%ebp 8048470: 83 e4 f0 and $0xfffffff0,%esp 8048473: 81 ec a0 00 00 ...


0

I don't know if I understand well, what you want. Let me know if I understand it bad. I will assume, you want to overwrite EBP with some your value. One of the way, how to do it, is find, where begin buffer and get its address. So in debugger fill buffer with some payload of 'A' like - run AAAAAAAA Set breakpoint after calling strcpy() function. I set ...


2

mov can be replaced by push and pop. So eg this: mov $0x3c,%eax Can become this: push $0x3c pop %eax Which would give you this null byte free code: 0: 31 ff xor %edi,%edi 2: 6a 3c push $0x3c 4: 58 pop %eax 5: 0f 05 syscall


4

Here are some C/C++ examples: Reading a long into an int memory space (say with scanf). int i; scanf("%ld", &i); Using a float as an index in a for loop instead of a fixed point structure, resulting in possibly one more or less iteration than expected. char *arr = new char[9]; for(float j=1; j>0; j=j-0.1) { // will clobber 10 characters, not 9 ...


0

Environment variables are 16 bytes from the base pointer (%ebp). Put a break point in the main function and do this, (gdb) x/wx $ebp+0x10 0xffffd3f8: 0xffffd48c (gdb) x/wx 0xffffd48c 0xffffd48c: 0xffffd67e (gdb) x/s 0xffffd67e 0xffffd67e: "XDG_SEAT_PATH=/org/freedesktop/DisplayManager/Seat0" (gdb) (gdb) x/wx 0xffffd48c+4 0xffffd490: ...



Top 50 recent answers are included