1

During writing some basic challenges, I discover that the exploits are not working if not launched in GDB. To test this behavior, the following program print register values and code address:

#include <stdint.h>

intptr_t esp;
intptr_t ebp;

void call_me()
{
  asm("movl %%esp, %0" : "=r" (esp) );
  asm("movl %%ebp, %0" : "=r" (ebp) );
  printf("call_me: %8x\n", call_me);
  printf("esp: %8x\n", esp);
  printf("ebp: %8x\n", ebp);
}


int main(char *argv[], int argc) 
{
   call_me();    
}

When compiled with -fno-stack-protector and -z execstack and running with ASLR disabled (kernel.randomize_va_space=0) the program returns:

call_me: 804841c 
esp: bffff720
ebp: bffff738

But when running inside GDB the program returns:

call_me: 804841c
esp: bffff6f0
ebp: bffff708

Why the 0x30 differences for $esp and $ebp ? Does GDB add something ?

2

The difference is very likely due to differences in the environmental variables of the process when the program is run with gdb compared to when it is run outside of gdb. Since environmental variables are stored on the stack, this can affect the memory locations.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.