1

I was trying to overwrite fp function pointer to 0x8048424(win() location) so that function win() will be called to solve this problem(machine is little endian)

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

void win()
{
  printf("code flow successfully changed\n");
}

int main(int argc, char **argv)
{
  volatile int (*fp)();
  char buffer[64];

  fp = 0;

  gets(buffer);

  if(fp) {
      printf("calling function pointer, jumping to 0x%08x\n", fp);
      fp();
  }
}

I am able to do this by overflowing buffervariable and then overwriting fp by doing python -c "print'A'*64 + '\x24\x84\x04\x08'" | ./stack3.

But my question is why we need hex escape sequences?I have saw this notation in many tutorials but none of them explained it purpose

I read about this and found that they can be used as escape sequences. for e.g \n(which is a newline character) can be written as printf("\x0A") and it will do the same thing. So it makes sense.

But when overwriting memory why we need this? I didn't understand it's purpose here in buffer overflow Why we cannot simply use python -c "print'A'*64 + '0x24840408'" | ./stack3. I mean we are just writing a memory address to a pointer variable.

PS My question is related to this question but unfortunately it doesn't answer my question that Why do we need \x notation in first place

2

A hex escape sequence \x{whatever} represents a single byte of data. That byte can represent different things depending on the program reading it. For instance, \x78 could represent the character "x", the number 120, 'the 120th byte of the following section', or any special meaning assigned to it in context. If you write the string of characters "0x24840408", it'll be interpreted as the string of bytes \x30\x78\x32\x34\x38\x34\x30\x34\x30\x38 (you may notice that the characters "0" to "9" are represented by \x30 to \x39). When you write character strings here, they're simply interpreted as the corresponding string of bytes, the computer doesn't look at what characters those bytes represent. When your debugger prints out the address "0x8048424", it's not printing what's actually stored in memory - it's trying to be helpful by interpreting the four byte sequence \x24\x84\x04\x08 that's actually there and printing a string of characters humans can understand (Also it can't print \x24\x84\x04\x08 as the characters it represents because three of those characters are either unprintable or invisible).

It would be possible for a program to convert the other way and turn "0x24840408" (or indeed "0x8048424") into \x84\x24\x04\x08 in memory, but the python interpreter doesn't do that by default because it's not often needed outside of exploit development. If you really do mean 'put this four-byte value into memory verbatim', that's what escape sequences are for.

So, to summarise: "0x24840408" is represented in memory by \x30\x78\x32\x34\x38\x34\x30\x34\x30\x38 \x24\x84\x04\x08 represents "$[three unprintable characters]"* (ie. \x24 represents $ - but we don't care what string it represents because we're interpreting it as an address)

*actually it'd usually be "$[one unprintable character]". \x08 as a character represents 'backspace', so it should remove the \x04 before it. But that's not really the point.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.