I wrote a simple c program in order to test an buffer overflow. My goal is to overwrite the rip so it points to the beginning of the buffer.
The code:
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main(int argc, char **argv) {
char buffer[256];
strcpy(buffer, argv[1]);
printf("INPUT: %s\n", argv[1]);
return 0;
}
When i write
r python -c 'print "A"*264 + "BBBBBB"'
in gdb the rip is correctly overwritten with:
RIP: 0x424242424242 ('BBBBBB')
The beginning of the buffer is at 0x7ffffffede20.
So i tried
r python -c 'print "A"*264 + "\x20\xde\xfe\xff\xff\x7f"'
in gdb to overwrite the rip but it doesn't work anymore.
This is the content of rip (copied from gdb):
RIP: 0x7fffff050800 (<__libc_start_main+192>:
add al,BYTE PTR [rax])
Why does it work with the "BBBBBB" but not with the address? And i also tried
r `python -c 'print "\x90"*264 + "\x08\xde\xfe\xff\xff\x7f"'`
And for some weird reason this works again with the address 0x7ffffffedf08. But just not with the one i need.
(Compilation: gcc mybof.c -fno-stack-protector -z execstack -o mybof)