1

I have a problem when trying to overwrite the EIP (basic 64 bit buffer overflow) with an address 0x0000000000400546 which is a function that is located in the same program .. the EIP is at 88 bytes .. so my code in gdb will be :

gdb> r python -c 'print "A"*88 + "\x46\x05\x40\x00\x00\x00\x00\x00"'

I finally get the address modified to : 0x00007fff00400546

Program received signal SIGSEGV, Segmentation fault. 0x00007fff00400546 in ?? ()

Image

Why it is modified with the 7fff in the middle? And how to point to this specific address?

  • 3
    Please do not post things like instructions or code with an image, instead, use the inline code formatting feature. – J.J Jul 31 '18 at 15:19
  • Are you sure you need 88 bytes to control rip register ? – game0ver Jul 31 '18 at 16:39
  • Please post in the comment section and not as an answer! Also I asked because how did you figure you can control rip with 88 bytes, did you make to successfully overwrite it using another hex value apart from 0x0000000000400546 ? – game0ver Jul 31 '18 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.