1

I am building a ROP chain for a security challenge. I have a problem in my ROP chain. I found some interesting gadgets with ropshell.com, and they seem to work pretty well except one. Indeed I follow the stack pointer on gdb peda and only one instruction has a problem which is pop eax, ret at the address 0x080a9d36. This instruction contains no null bytes but the stack pointer apparently doesn't recognize it and send me a segfault Stopped reason: SIGSEGV - 0x08009d36 in ?? ().

I just don't understand why the 0a becomes suddenly a 00. Would someone have an idea ? Thanks.

3

Actually, I found the problem. This is about the fact that the address of this gadget contains 0a which corresponds to a \n

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.