2

I have a problem when trying to overwrite the EIP (basic 64 bit buffer overflow) with an address 0x0000000000400546 which is a function that is located in the same program .. the EIP is at 88 bytes .. so my code in gdb will be :

gdb> r python -c 'print "A"*88 + "\x46\x05\x40\x00\x00\x00\x00\x00"'

I finally get the address modified to : 0x00007fff00400546

Program received signal SIGSEGV, Segmentation fault. 0x00007fff00400546 in ?? ()

Image

Why it is modified with the 7fff in the middle? And how to point to this specific address?

Improve this question
3
  • 3
    Please do not post things like instructions or code with an image, instead, use the inline code formatting feature.
    – user173641
    Commented Jul 31, 2018 at 15:19
  • Are you sure you need 88 bytes to control rip register ?
    – game0ver
    Commented Jul 31, 2018 at 16:39
  • Please post in the comment section and not as an answer! Also I asked because how did you figure you can control rip with 88 bytes, did you make to successfully overwrite it using another hex value apart from 0x0000000000400546 ?
    – game0ver
    Commented Jul 31, 2018 at 19:18

1 Answer 1

Reset to default
1

Without knowing the of the vulnerable code I'm going to guess that the vulnerable function uses a C based string operation like strcpy() which terminates on null byte. Hence your string stops writing after \x46\x05\x40\x00 as it encounters a null byte. This results in a partial overwrite and the 0x00007fff portion of the 0x00007fff00400546 address is whatever value was already on the stack.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .