Stack Protection off but still cant overwrite EIP

Question

When Compiling with:

gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32

I am able to overwrite the return address with just about any value except a valid return address.

When I try to use a Valid return address the last byte gets overwritten with something differentsuch as 0xffffd8fe I get bad address..

So what I am asking is even though I have shut off stack protection, shutoff pie, and enabled execution of the stack, also set kernel ASLR to 0, is there any other reasons why this would cause failure to completely control EIP?

Here is the Code I am not asking you to solve this for me, I am just asking for some advice as to why this acts the way it does!

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
void validate(char *pass) {
    if (strcmp(pass, "[REDACTED]") == 0) {
        printf("ACCESS GRANTED!");
        printf("Oh that's just idio... Oh my god!\n");
    } else {
        printf("Damn it, I had something for this...\n");
    }
}
 
int main(int argc, char** argv) {
    char password[200];
    printf("C:/ENTER PASSWORD: ");
    scanf("%s", password);
    validate(password);
    return 0;
}

Note: in case this matters my system is x86_64 and i compiled the binary as x86, this program does have badchars which are "\x09 \x0a \x0b \x0c \x0d \x20", and the payload structure is as follows. payload = "A"*132+ret+28byteshellcode+"A"*44 .

Answer 1

Your second example dies due to 0xffffd8fe pointing to an illegal instruction. It seems a poor address for a blind ret or jump esp pivot into your shell code (should be in the binary 0x0804xxxx). It also seem like a poor address for your shellcode as it should be located somewhere closer to 0xbfff0000. Try putting a breakpoint on the address you are overwriting EIP with before running the payload. That way you can confirm execution (breakpoint hit) and inspect the instructions.