I'm trying to overwrite a return address by using buffer overflow.

  1 #include <stdio.h>
  2 #include <string.h>
  4 void jumphere(){
  5     printf("SUCCESS!!");
  6 }
  8 int main(int argc, char** argv){
  9     char buffer [8];
 10     strcpy(buffer, argv[1]);
 12     printf("%s\n", buffer);
 14     return 0;
 15 }

I found that the return address is 0x00007ffff7a05b97

(When the main function ends, the last address that $rip points is 0x00007ffff7a05b97)

and the address of a function that I want to jump to is 0x0000000000400577.

So, I filled the buffer with As and gave an additional input of +"\x77\x05\x40\x00\x00\x00".

The return address is overwritten, but it became 0x00007fff00400577.

It seems that additional "\x00"s are ignored because \x00 is a NUL byte.

But that return address doesn't jump to the function that I want.

How can I overwrite the return address that has "\x00"s?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.