Looking around trying to answer my question i found those compilation parameters:
- Heap exec
- Sf (source fortification)
- ASLR (not a compilation parameter, i know)
From what I understand, none of these protection are responsible for the issue which I'm facing.
I'm attempting to do a buffer overflow on a binary with at least the ASLR activated. Using gdb-peda and I managed to find the offset at which i overwrite the saved value of the IP register. This offset is
170. Using a cyclic pattern (
pattern_create 174 within gdb-peda) containing
174 characters and ending with
'AtAA' i manage to get IP to contain
EIP: 0x41417441 ('AtAA') after the
At that point I was like : "Yeah that looks good". I then (not knowing at that time that ASLR was up) built my payload and it weighed also 174 bytes.
When running this binary with this payload, i can't manage to alter neither the value of EIP nor the one of EBP. While it worked perflecty fine with the cyclic pattern with the exact same length. Meaning that i can cause the program to segfault because the instruction at
0x41417441 is not a proper instruction.
So I assume that there is some kind of protection which understand that there is some shellcode in the stack and that it protects the ip register ? Even tho it doesn"t at any point raise an exception.