New answers tagged

2

The strcmp call and what leads to it is correct. Your second hunch, to somewhat suppress the signal, is the right one. signal(SIGABRT, SIG_DFL); … raise(SIGABRT); The call to raise raises a signal whose default action is to kill the program. The prior call to signal ensures that the default action is taken. When a process signals itself, this is ...


2

Make strcmp to be 0 Assuming a correct implementation of strcmp, this means argv[1] must match the contents of level08.pass exactly for 63 bytes or until the first newline/null byte. Since we don't know the contents of the file, our only option would be to manipulate argv[1] to point to an address in memory containing the correct string (e.g. ...


0

It seems like it execs the shell if you enter the first line of /levels/level08.pass. Maybe you can use a timing attack to check where strcmp exits, and use that to guess one character at a time.


2

There is a pretty good explanation at the following link on stackoverflow: reverse engineering c programs Short answer: There is no way to get exactly the same code that you have on a C written program. It passes through many stages until it reaches binary code for a specific machine. It is somehow compared to an ice cube that melted, assuming that you ...


7

The issue of using of using memory outside its lifetime is that its content might have changed in an unexpected way. Consider a dynamically allocated structure with a function pointer as field. If this memory is somehow freed, it is possible that the next memory allocation request points to this memory. An attacker controlling this memory might put data in ...


0

Looking at google certificate’s, it’s now very clear… The answer is yes of course since you can request to be a certificate authority for the domains you control…



Top 50 recent answers are included