2

Is possible to exploit a program if you can only overwrite ESI or EDI register without EIP? Program in question does seg fault and overwrite EDI, ESI and ECX but can't get it to overflow EIP. Anyone know why? Thanks, Tom

3
  • 2
    Maybe. It depends entirely on what the program does with the ESI and EDI (and for that matter ECX) registers.
    – Mark
    Commented Apr 23, 2015 at 4:06
  • It would really help to have a lot more context on this question. What's the program, what's the exploitation method you tried? Commented Apr 23, 2015 at 8:37
  • Getting from segfault to exploitation is not always a given and entirely depends on your program. Without at the very least code excerpt from the vulnerable part, it's not possible to answer this question.
    – Dillinur
    Commented Apr 23, 2015 at 9:14

1 Answer 1

2

Almost certainly, but it may not translate to a reliable exploit. As you are controlling ESI, EDI and ECX you are most likely controlling a byte copy operation and I'm assuming the crash is caused because you're trying to read/write to an address like 0x41414141.

At worst you can hard code some addresses where ESI points at the start of your shell code, EDI points to the next instruction address (EIP+opcode bytes). ECX should be the length of your shellcode. This will overwrite the next series of instructions with your shell code.

For a more reliable exploit you would have to do some more analysis on how you ended up controlling these registers and what code paths are available depending on what you point these registers at.

2
  • Of course, "This will overwrite the next series of instructions with your shell code." assumes a system without W^X
    – Ben Voigt
    Commented May 3, 2015 at 20:40
  • My guess is if you can set ECX to a smaller (but large enough) value, EDI to a writable page (perhaps somewhere below the saved EIP) and ESI to somewhere within your buffer, you’ll end up getting %pc control. As wireghoul implied, EDI, ESI and ECX are commonly used to copy a count of ECX bytes from memory at ESI to memory at EDI. However, it’s also used for comparisons of memory, so you may be hosed- as an example, both strncmp/memcmp and memcpy/strncpy have this calling convention
    – adam
    Commented Jun 4, 2022 at 18:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .