1

I'm currently practicing buffer overflow. And I have a question for you regarding fuzzing.

I am able to develop a python script that will try several buffer sizes to crash an application. It works well, and returns the buffer size to which the application crashed.

However the value I get from my script is not necessarily the size that "allows EIP rewriting". To find this buffer size I usually have to grope...

The problem is, when I look for the exact number of byte, I am forced to :

  1. Start my debugger (edb-debugger) on kali.
  2. Launch the application
  3. Launch my script with +1 or -1 at the buffer size
  4. Check if EIP is overwritten

If this is not the case, I start over and over again...

It's an operation that wastes too much time. Can we make this step faster? With an extra setting in the debugger that will automatically restart the application as long as EIP is not overwritten? Or with a specific setting in a script?

In my case the application (crossfire) crashes at 4377 bytes first. but EIP is not overwritten.

4378 bytes, it's the same thing.

And 4379 bytes, it's Good !! EIP is Overwritten !

But when i try 4380 (or higher), EIP isn't overwritten... and i don't understand why.

2

Maybe I am misunderstanding but usually overwriting too much is not a problem.

The common approach therefore is to overwrite more than necessary but using a specific pattern. Looking at what ends up in EIP and searching for it in the pattern will tell you the exact position of the data that ends up in EIP.

Exploitation tools usually have this for, example PEDA has the pattern functionality.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.