1

I'm playing around with buffer and heap overflow vulnerabilities, and it is all fine to exploit stuff when you have the source code and can see all the variables, their sizes and values, etc. But, what if I only have the compiled program, and I need to find a size of an array. For example, if we take the sample program below, which has declared some variables and an array, and at a later stage of the execution the array is passed to another function.

int main(int argc, char **argv) 
{
   char test;
   char arr[100];
   double someVar;

   // Somewhere in the main call another function with array
   myFunc(arr);

   ...
}

If I didn't have the source cod,e but knew that the array is passed somewhere (gueesable), how would I go on to determine the size of the array? I mean I can always try to write something like a script where I always pass larger and larger argument to the program from command line, and see where it fails, but this is not a very practical approach (in my opinion). I guess reverse engineering may give some information, but how exactly? Can gdb also provide something useful? I mean what would be methods to determine the size of the array if the source code is not known?

1 Answer 1

2

There is a pretty good explanation at the following link on stackoverflow:

Short answer: There is no way to get exactly the same code that you have on a C written program.

It passes through many stages until it reaches binary code for a specific machine. It is somehow compared to an ice cube that melted, assuming that you have lost no water through evaporation. There is no way to get the original ice cube EXACT shape, unless you have a mold(and yet, the internal formation will not be the same).

Having a good translator that could look at assembly pieces and figure out whenever it could be an array, would be the best solution. But this tool does not seems to exist as far as i know.

This guy at re.stackexchange have some tips on how to look at the disassembled code, and get the information you want about C arrays:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.