Here is the gist of the code:

  char s1[64], s2[64];
  int a = 0, b = 0;
  FILE *fp1, fp2*;
  char temp;
  scanf("%s", s1);
  scanf("%s", s2);
  //some checks happen, fp1 is opened to s1, fp2 is opened to s2,
  temp = fgetc(fp1);
  while(temp != EOF) {
    fputc(temp, fp2);
    temp = fgetc(fp1);

In the first scanf I can overwrite the saved EIP and everything is fine until I step through that middle section. When the first (I'm using an empty file for s1 so it's also the only time it runs) fgetc returns the memory where the saved EIP is has been changed from 0x-------- to 0xff------. When I step through it it seems to happen in /lib/ld-linux.so.2

As this is homework hints are strongly preferred but if you want to see the whole c, binary, or asm here's the link.

  • 3
    We really appreciate it when people specify that it's homework. Thanks!
    – schroeder
    Mar 13, 2015 at 20:27


You must log in to answer this question.

Browse other questions tagged .