The context :

I have a small question regarding ESP and access violation. I just exploited a buffer overflow, with little space after ESP. So i did this :

part 1 : NOP SLED

part 2 : my shellcode : a shikata_ga_nai encoded reverse_tcp payload, by metasploit

part 3 : some more NOP to fill the space

part 4 : 4 bytes overwriting the EIP saved in the stack. This is the address of a jump ESP instruction in a non ASLS protected segment.

part 5 : [This is where ESP point to at the moment of the crash] I have some NOP

part 6 : the first stage of my exploit :

for the first stage, avoiding \x00 bytes, I did :

mov eax,esp
sub eax,944 (point to the part1 : the NOP sled)
jmp eax

It worked fine : stack is overwritten, EIP goes to the jmp ESP instruction, arrives in the part 6 of the exploit, it jumps to EAX, wich point to the part 1 of the exploit, and then executes the NOP to arrive to the shellcode.

problem : I got some access violation inside the shikata_ga_nai decoder.

I solved it, adding a mov esp,eax in the first stage :

mov eax,esp
sub eax,944 (point to the part1 : the NOP sled)
mov esp,eax
jmp esp

And it worked like a charm. So that would means one can not play with the memory in lower addresses than ESP.

The question :

Does ESP really has anything to do with read/write permission inside (outside actually) the stack ? The memory there was allocated, so I used it. Has EBP or other register anything to do with access violation ?

  • Stack grows towards zero... if you use classic buffer overflows you write to a base address + OFFSET meaning you can't touch anything that is on lower addresses than that buffer. Also, below ESP you might encounter unallocated memory which you can't just arbitrarily write to. – mroman Oct 12 '17 at 14:11
  • If you are using a str-family function to copy your data to the buffers, you might want to avoid other characters aswell besides \x00 (that I dont recall right now), since it could end the copying midway – luizfzs Jan 10 at 11:09

No, both registers just point to stack addresses, with ESP being the top of the stack and EBP the base of the stack frame (usually).

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.