3

I am working with this INE eCXD material and I am working on my basics of buffer overflow on Linux. In the lab, there is supposed to be a binary that is using the strcpy() function and it SEGFAULTS when it reaches that function. I loaded the binary in GDB-PEDA and set a breakpoint at strcpy().
When I run the binary it pauses at my breakpoint. but when I view the registers it shows up like the below image.

enter image description here

At this point I am supposed to investigate starting from the ESP.
What I don't get it is why does the ESP ( and of course the other registers) looks like that ?
ESP: 0xffffd2cc --> 0x8048493 (add esp,0x10)
Isn't the ESP supposed to hold one address, so what does it mean when in looks like that?

One more thing:
When I read the write up, I found that they examined the 0x8048493 as a return address which I didn't get, but I am going along with it at the moment. They started examining the address using this instruction
x/20i 0x08048493-20 [Which basically means examine 20 instructions starting from the mentioned address].
The result was:
enter image description here

By mistake I entered the below instruction:
x/20i 0x08048493 [dropped the 20]

which resulted in the below results

enter image description here

I want to know why both of the results are different, isn't it supposed to mean to examine the next 20 instructions starting from the given address.

Improve this question

1 Answer 1

Reset to default
2

So I just started learning this stuff last week and I've been using raw gdb not this cooler looking one, so take this with a grain of salt if you will. Anyone else can correct me if I'm wrong.

For your first question, the ESP does hold one address, which from that picture is 0xffffd2cc. It looks like this: ESP: 0xffffd2cc --> 0x8048493 (add esp,0x10) because the ESP is currently pointing to address 0xffffd2cc, which the address of a pointer to 0x8048493, which contains the instruction (add esp,0x10)

For your second question, it does mean examine the next 20 instructions starting from the given address. The command is x/20i <starting address>, and in your first picture the starting address is 0x08048493-20, which 0x08048493-0x14 = 0x0804847f.

In your second picture you forgot the -20, so the starting address is just 0x08048493. If you compare everything just after the strcpy@plt in your first picture at address 0x0804848e, you'll find that the rest of the instructions are identical.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .