I'm currently practicing buffer overflow. And I have a question for you regarding fuzzing.
I am able to develop a python script that will try several buffer sizes to crash an application. It works well, and returns the buffer size to which the application crashed.
However the value I get from my script is not necessarily the size that "allows EIP rewriting". To find this buffer size I usually have to grope...
The problem is, when I look for the exact number of byte, I am forced to :
- Start my debugger (edb-debugger) on kali.
- Launch the application
- Launch my script with +1 or -1 at the buffer size
- Check if EIP is overwritten
If this is not the case, I start over and over again...
It's an operation that wastes too much time. Can we make this step faster? With an extra setting in the debugger that will automatically restart the application as long as EIP is not overwritten? Or with a specific setting in a script?
In my case the application (crossfire) crashes at 4377 bytes first. but EIP is not overwritten.
4378 bytes, it's the same thing.
And 4379 bytes, it's Good !! EIP is Overwritten !
But when i try 4380 (or higher), EIP isn't overwritten... and i don't understand why.