Tag Info

New answers tagged

2

You should disassemble the function func() too in order to have a better idea how things are going on. Moreover, I did not understood the role of your call to strcpy(), just a cause of segmentation error for me I commented it out to make your code work. Do not forget that the sizes you can see in the code are printed in hexadecimal, while you input the ...


0

As you have already identified you will need to return to address 0x400631. When you smash the stack with your argument you should control EIP. Ie: ./a.out AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA You should see EIP of 0x41414141. Now you need to determine where in your stack of A's the 4 bytes that becomes EIP are ...


-1

while I do not agree with your plan, the way to skip an instruction is to modify the callers' pc register value, that is saved on the called functions' stack So skipping one instruction is rather simple, because instruction size (in modern CPUs) is relatively consistent. However skipping a line of C code is a whole different problem because the line ...


2

You should stick with /dev/urandom. Thomas Hühn has a good overview at http://www.2uo.de/myths-about-urandom/ If you are really concerned you can look at using a user space CSPRNG. Stick with well understood CSPRNGs (e.g. Blum Blum Shub, although it has some performance issues) and respected implementations. You might want to read ...


0

RC4 has its flaws and arc4random specifically had some issues about 7 years ago (CVE-2008-5162) yet it is expected to be secured Also, note that urandom is not the best idea or as Wikipedia says: A counterpart to /dev/random is /dev/urandom ("unlimited"[5]/non-blocking random source[4]) which reuses the internal pool to produce more pseudo-random bits. ...


1

There was some very carful algebra done on this site on the variables that manage a doubly linked list of addresses. Have you investigated the source code in for malloc.c and unlink to see that the code has not changed in some way? I believe you will find your problem in there.



Top 50 recent answers are included