Questions tagged [assembly]

Assembly language is a low-level programming language whose instructions map almost 1-to-1 to a computer's machine code.

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

why does my shellcode segfault assembly x86-64bit? [migrated]

When I compile my shellcode and run it, Strace does not show an error. When I use my shellcode tester, I get a segmentation fault. I don't know why, maybe there's a smarter guy than me who can help me ...
Marius Romeiser's user avatar
0 votes
0 answers
65 views

How do I prevent the random alignment of the instructions during debugging using gdb? Even tried turning off the optimization with -O0 in gcc

I have started with the book 'Hacking: The art of exploitation!'. I know some of you might suggest that it's pretty old... But I think great buildings withstand due to their strong foundational base. ...
Aniket D.'s user avatar
0 votes
1 answer
88 views

what is stack segment manipulation?

I was trying to research about anti-debugging techniques here, but i failed to make sense of what stack segment manipulation's. Could anyone have a good explanation for what it means or nice resources ...
winterr_dog's user avatar
1 vote
2 answers
499 views

Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C

I wrote a NASM program that uses the execve system call to run wget inside a newly spawned shell and execute the retrieved page: [bits 64] global _start section .text _start: xor rcx, rcx ...
Vilius Povilaika's user avatar
0 votes
1 answer
338 views

ROP - ret VS ret 0

I'm doing a binary challenge from pwnable.kr and I'm examining a some ROP gadget. Until now I've always used gadget ending with ret or syscall/int 0x80, but now ROPgadget gave me a gadget ending with ...
Marco Balo's user avatar
4 votes
1 answer
525 views

Why does my RIP value change after overwriting via an overflow?

I've been working on a buffer overflow on a 64 bit Linux machine for the past few days. The code I'm attacking takes in a file. This original homework ran on a 32-bit system, so a lot is differing. I ...
sneakyfishies's user avatar
17 votes
2 answers
3k views

How are code-branch side channel attacks mitigated on Java?

When you are working with secret keys, if your code branches unequally it could reveal bits of the secret keys via side channels. So for some algorithms it should branch uniformly independently of the ...
Guerlando OCs's user avatar
0 votes
1 answer
2k views

How to use pwntools to generate a relative jump?

I want to use pwntools to generate a relative jump 0x20 bytes forward. It isn't described in the documentation how to do that. What's the command for doing a JMP SHORT 0x20 in pwntools?
user3207874's user avatar
0 votes
1 answer
534 views

Some introductory reverse engineering help on finding a string

I understand the crackme I am researching is from 2007, however this was the point in my life when I initially became interested in reverse engineering and wish to complete it for nostalgia sake. ...
questioner's user avatar
0 votes
1 answer
2k views

Instead of JMP ESP can we use it's opcodes?

In a buffer overflow exploit, when we use a JMP ESP instruction to jump to the ESP, instead of using the address of the JMP ESP, can't we use the opcodes of it?. I generated the opcodes of the JMP ESP ...
Kavishka Gihan's user avatar
0 votes
2 answers
440 views

Shellcode not executing despite EIP being overwritten properly

Here is my exploit: junk = b'A' * 1032 ​ eip = b"\xf5\x93\x4a\x00" # some address where 'jmp esp' lives shellcode = b"" shellcode += b"\x33\xc0" # xor eax, ...
Toma's user avatar
  • 121
1 vote
0 answers
948 views

msfvenom: how to output assembly of windows payload for inline assembly in C?

My goal is to obfuscate metasploit windows payloads' assembly code (adding junk code to the payload itself), then adding the obfuscated shellcode to inline assembly in C. The issue is there is no ...
pokkery98's user avatar
1 vote
2 answers
529 views

How do attackers determine ROP gadgets remotely?

Being gadgets change per each system and architecture (do they?), how would an attacker be able to determine the offsets of various Return Oriented Programming gadgets, would an attacker first need to ...
asd40732's user avatar
1 vote
1 answer
1k views

Understanding ret2libc return address location

I recently was studying x86 buffer overflows + ret2libc attacks from https://www.ret2rop.com/2018/08/return-to-libc.html and I noticed the order is as follows: bytes to fill buffer + address of system ...
asd_665's user avatar
  • 13
0 votes
1 answer
3k views

What is source of bad characters exist in buffer overflows

I'm new to exploit development and while watching a tutorial I came across the topic of "Bad character identification". I'm referring to the process of sending all possible characters to the ...
Anton.P's user avatar
  • 141
1 vote
2 answers
828 views

How does ASLR work if in the assembly code the addresses are the same

Let's say I have this piece of code that changes the 10 address to the value 20 and the following one to 30 mov ebx,10 mov [ebx],20 add ebx,1 mov ebx,30 How can the address change each time it is ...
for the's user avatar
  • 13
1 vote
0 answers
289 views

Exploit - Code execution without assembly call instruction, int etc on ia_64

Found a bug in a function in a loop where I can go past a loop in assignment where value is read from past malloced memory The function has no call, int or other assembly instructions afterwards. ...
dev's user avatar
  • 997
2 votes
1 answer
3k views

vulnserver - Can't find JMP ESP in ntdll.dll

This tutorial shows how to find a JMP ESP in nttdll.dll http://sh3llc0d3r.com/vulnserver-trun-command-buffer-overflow-exploit/ Find address for EIP In this step we have to check the registers and ...
Wolf's user avatar
  • 367
2 votes
1 answer
600 views

Memory address problem in GNU Debugger

I'm new to gbd. I've wrote a simple program which will print hello world 10 times(I've listed the program in the screenshot). Then I've displayed the assembly language and set the break point to main ...
Abhirup Bakshi's user avatar
0 votes
1 answer
470 views

Esp changes to different (incorrect) value when overwritten

I am attempting to overwrite the eip of a binary (in order to perform a ret2libc attack). The program has full relro, PIE and NX. Here's my thought process. First I try this, I input "C"*260 + "...
elmuscovado's user avatar
1 vote
0 answers
844 views

Buffer bomb level 3 - Prevent stack corruption

I am trying to complete level 3 of buffer bomb lab. The task is to supply an exploit string that will cause getbuf to return my cookie (0x4b64b076) back to test, rather than the value 1. The exploit ...
Helen Grey's user avatar
0 votes
1 answer
504 views

Reverse engineering and buffer overflows: zero to hero [closed]

When I do CTFs, I can usually cope well with and understanding everything pretty much apart from buffer overflows, binary exploitation and reverse engineering Almost to the point that I would ...
pee2pee's user avatar
  • 287
1 vote
1 answer
615 views

Remote Buffer Overflow w/out Memory Leak

I'm working on an exploit development challenge right now in which I've been presented with a compiled binary and I have to exploit it on a remote server. No stack protections have been enabled and ...
leaustinwile's user avatar
4 votes
1 answer
17k views

Problem with overwriting the return address (buffer overflow)

I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function: #include <string.h> #include <stdio.h> void overflowed() { printf("%s\...
user1758952's user avatar
1 vote
1 answer
2k views

What is the purpose of the instruction fldz on the Aaron Adams shellcode?

I'm studying the Aaron Adams assembly code. You can find the documentation here (section --[ 2.b.i Getting EIP). I understand that the goal is to get the EIP. I know that the FPU environment looks ...
salt's user avatar
  • 259
3 votes
1 answer
3k views

How does this simple buffer overflow work?

I've got this simple code vuln.c #include <stdio.h> #include <string.h> int main(int argc, char** argv) { char buffer[500]; strcpy(buffer, argv[1]); printf("%s", buffer); ...
Izy-'s user avatar
  • 873
3 votes
1 answer
192 views

Running a brief asm script inline for dynamic analysis

Is there any good reason not to run a brief unknown (30 line) assembly script inline in a usermode c program for dynamic analysis directly on my laptop? There's only one system call to time, and at ...
comp.sci.intern's user avatar
5 votes
2 answers
6k views

Why does my stack contain the return address to __libc_csu_init after main is initialised?

I wrote a simple program in C, compiled it, opened it in gdb, set a breakpoint at line 11 and inspected the stack. 1 #include<stdio.h> 2 3 int main(int argc, char *argv[]){ 4 char ...
Hugh Pearse's user avatar
1 vote
2 answers
315 views

is it possible to craft exploits for non-open source C/C++ software without fuzzing?

imagine that if i wanted to find a vulnerability in a program that is used by a lot of people in order to exploit it. the program is open source and is written in C/C++ . would this even be possible ...
harry's user avatar
  • 21
1 vote
0 answers
365 views

Why can't I see my shellcode executing in Immunity Debugger?

I am doing an exercise on creating custom shellcode (windows). The goal is to create shellcode that will delete the firewall log file. I successfully spawned a reverse shell with metasploit, using a ...
Ben P's user avatar
  • 11
31 votes
4 answers
19k views

I feel like it's impossible to learn reverse engineering [closed]

I know how to use most of the tools in Kali like msfvenom and msfconsole and I can safely call myself a script kiddie. I learned the basics of C# and that helps me understand some of the things in C, ...
Nikolay Atanasov's user avatar
2 votes
2 answers
3k views

Overflowing the buffer yet not jumping to address

I am a beginner at buffer overflows been studying this subject from a few days and i found this exercise (code from: here) I think understand the basic concept i write more than 64 bytes characters ...
Nikolay Atanasov's user avatar
3 votes
3 answers
2k views

What assembly should I learn? [closed]

I want to learn assembly, but I am not sure what instruction set (if that is correct term?) I should learn? I have prior experience in programming, and I did a degree in Computer Science but ...
user5623335's user avatar
4 votes
2 answers
4k views

Why do we need to remove null bytes from shell code?

I'm studying the basics of making shell codes. I have a question about it. In my textbook, the author stores his shell code in an environment variable, and injects the address of it using strcpy() ...
John Smith's user avatar
1 vote
1 answer
596 views

Binary Exploitation - How to set GID of a SUID binary using shellcode?

I have a binary that is SUID which I can currently use a buffer overflow exploit to obtain an elevated EUID shell. However I haven't worked much with changing IDs through shellcode, and the file I ...
Sif's user avatar
  • 13
7 votes
1 answer
2k views

Why would legitimate programs have a `jmp esp` instruction?

It appears that a common exploit trick is to use stack overflow to overwrite the instruction pointer such that it points to a jmp esp instruction somewhere in the code segment which then executes the ...
1110101001's user avatar
3 votes
1 answer
8k views

Buffer overflow: Why does the ESP Register change its value after access violation

Background: Currently trying to exploit a BoF vulnerability. After setting up the environment, running a compiled C program that contains the strcpy function, I disassembled the program as it's ...
0x5929's user avatar
  • 355
2 votes
2 answers
1k views

C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?

General Background: I have written an echo server trying to implement an example of BoF in C that utilizes a strcpy() function call like such: // .... including the corresponding libraries depending ...
0x5929's user avatar
  • 355
2 votes
2 answers
4k views

Shellcode doesn't execute and EIP is overwritten

I've written a vulnerable program (below) and some shellcode (also below) to use in a buffer overflow exploit. I've had the same problems as in this link, and solved those using the answers there (-z ...
Henrik Oldcorn's user avatar
0 votes
1 answer
167 views

Can an attacker add malicious instructions to a cracked Password Manager app to exfiltrate credentials ? (1Password, oneSafe, etc.)

(In OSX) Would it be possible for an attacker to add into a password manager app (cracked illegal version, downloaded from a pirate website), instructions to make the program send credentials over the ...
scugn1zz0's user avatar
  • 113
0 votes
1 answer
562 views

Stack Protection off but still cant overwrite EIP

When Compiling with: gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32 I am able to overwrite the return address with just about any value except a valid return address. ...
zeroskilz's user avatar
4 votes
2 answers
1k views

Custom EXE Template Metasploit 64-bit ASM PE Syntax

I asked this previously then deleted since I think I asked the question without gearing it towards msfvenom and custom EXE templates. There is a 64-bit Windows PE written in assembly that ships with ...
user9225381's user avatar
1 vote
2 answers
792 views

Why is this shellcode execution considered an exploit?

I found the following "exploit" on Twitter: https://www.exploit-db.com/exploits/43550/?rss Blogpost about it: https://pentesterslife.blog/2018/01/13/polymorphic-and-smaller-versions-of-three-shell-...
Daniel W.'s user avatar
  • 267
4 votes
2 answers
9k views

Buffer Overflow doesn't have enough space for exploit after being crashed

So I'm trying to write a buffer overflow for a knowingly vulnerable server application, I want to learn how to do this on my own and just want some direction. I'm watching it in immunity debugger on ...
Hadoken's user avatar
  • 53
2 votes
1 answer
1k views

Challenge: Shellcode with unique bytes

Is it possible to have a (small) shellcode with unique bytes only? So far I noticed the smallest shellcode I can find online is 19 bytes for Linux x86, but it does repeat bytes, especially the "/" ...
Alex's user avatar
  • 131
6 votes
1 answer
907 views

Curious about Microsoft "Buffer Security Check" implementation

A very quick background to help you answering my questions : Learning IDA Interactive Disassembler, the old free edition (too expensive for a hobbyist) 15 year Linux Sysadmin & DBA experience ...
ker2x's user avatar
  • 163
5 votes
1 answer
7k views

How to bypass ASLR with ROP

I was reading this article by the InfoSec institute: http://resources.infosecinstitute.com/an-introduction-to-returned-oriented-programming-linux/#gref And was able to follow along until he did the ...
alloy's user avatar
  • 51
0 votes
1 answer
612 views

Mov byte to addres inside a register

I am trying to write a shell insertion decoder (my encoder works as expected). But when I try to move one byte to the address inside a register i face a Segmentation fault. The error happens in this ...
alacerda's user avatar
  • 125
4 votes
1 answer
1k views

How can Malware authors be determined? [duplicate]

My question is: How can we make any conclusions about malware authors at all, when anyone could just get sample malware online, copy paste the parts they like, and add their own parts to it? ...
PositriesElectron's user avatar
1 vote
2 answers
2k views

Segmentation fault error when calling user defined function in shellcode

I am getting the segmentation fault error when I called function "target" in my shellcode. Here's the C code of program: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #...
Rakesh Mane's user avatar