I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses strcpy, so I cannot overwrite the $ra register with an address that contains null bytes (0x0040xxxx).

Any ideas how to overcome this issue?


  • strcpy will write one \0 byte. Maybe that's enough? Other ideas: are heap or stack executable, and can you "heap spray" them - in other words, maybe there's more to this than written in the question. – domen Oct 5 '20 at 7:57

This is a classic badchars problem. So your goal is to make your final exploit to NOT contain any of the bad characters. Encoding can help you achieve that. A possible obvious solution to exploit this, is combining ROP + encoding. For example you can create an encode() function, that uses e.g. XOR, like the one below:

def encode(s, key):
    return ''.join(chr(ord(i)^key) for i in s)

and then search for possible gadgets that help you create the decoding function (e.g. search for xor gadgets):

def decode(address, key):
    create a ROP-chain here 
    that XORs the XORed string
    # create the ROP chain...
    return chain

and then in the main body of your exploit use something like this:

# ...skip...
# write_into_mem() is a just function that allows you to write into memory...
# write string (encoded/xored) into memory so you can avoid bad characters...
payload += write_into_mem(address,   encode('string_with_bad_chars', key))
for i in range(len('string_with_bad_chars')):
    payload += decode((address + i), key)

In this way you will avoid bad characters.

Note: The above code-snippets are in python. Use whatever language you prefer!!!

  • Thanks for the response, but I'm not sure how useful it is. I can overwrite the return address register ($ra), but since ASLR in enabled I don't know the addresses of the libraries. The binary itself is loaded always at the same address, 0x00400000, but I can't overwrite with gadget frome the binary itself because of the leading 0x00 null byte. So my problem is to find valid location to jump to.. – takadito15 Sep 11 '19 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.