2

I have some issues trying to resolve a war game with a format string vulnerability. So here is the code of the program:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main(int argc, char ** argv)
{
    char text[1024];
    if(argc!=2)
    {
        printf("Usage : %s <texte>\n",argv[0]);
        exit(0);
    }
    strncpy(text,argv[1],1023);
    printf("Voici votre texte :\n");
    printf(text);
    printf("\n");
    exit(0);
}

So you can see the code disassembled and I assume that the call at 0x80484fb is the call to the vulnerable function.

gdb analysis

First, I don't understand why there are already those values from 0xbffff834 to 0xbffff84c on the stack. Indeed, the value on the top of the stack (added in 0x80484f8 in the main thread) seems to be the argument passed to the printf function but I don't know what are those other values passed before.

The second thing I don't understand is why does the result not show the address 0xbffff840 and start printing 0xbffffe1b. I though that the %x would print the first value of the stack and then the second and carry on like this.

  • Please don't post code in pictures; it is hard to read (or impossible, for some). Instead, copy paste the code into the question. – Anders Apr 12 '18 at 11:30
  • @Anders Honestly, I think this is a case where it is fine to post a picture. The output is colored and specially formatted due to being from a debugger. – forest Apr 12 '18 at 12:00
  • @forest Granted, this is 100x better than just a lazy screenshot with lots of irrelevant junk around it. Still not a fan, but I see your point. – Anders Apr 12 '18 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.