Databases
StackOverflow2013
Postsdbo
POfunction's return address is different from its supposed value, buffer overflow, HELP PLEASE
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POfunction's return address is different from its supposed value, buffer overflow, HELP PLEASE
    primarykey
    data
    text
    <p>Good day everyone!</p> <p>I am trying to understand how buffer overflow works. Right now, I’m in the process of determining the address of a function’s return address which I’m supposed to change to perform a buffer overflow attack. I’ve written a simple program based from an example I’ve read in the internet. What this program does is it creates an integer pointer to store the address of the function's return address in the stack. To do this, (granted I understand how a function/program variables get organized in the stack), I add 8 to the buffer variable’s address and set it as the value of ret. I’m not doing anything here that would change the address contained in the location of func’s return address. </p> <p>UPDATE: I've modified the program a bit, so it prints the stack address of func's parameter a. As you can see, the distance between a and buffer is about 8 bytes, so that would probably mean, based from the stack layout, that saved FP and old EIP (func return address) is in between. Am I right?</p> <p>Here's the program:</p> <pre><code>void func( int a){ char buffer[3]; int *ret; ret = buffer + 11; // this is the configuratio which made the whole program works... This now points to the address containing func's return address printf (" address of a is %d\n", &amp;a); printf ("address of buffer is %x\n", buffer); printf ("address of ret is %x\n", ret); printf ("value of ret is %x\n", (*ret)); } void main(){ int num; num = 0; func(num); num = 1; printf("Num now is %d", num); } </code></pre> <p>Output of the program when gets excecuted:</p> <p><a href="http://img20.imageshack.us/img20/2034/72783404.png" rel="nofollow noreferrer">alt text http://img20.imageshack.us/img20/2034/72783404.png</a></p> <p>As you can see, I’m printing the address of the variables buffer and ret. I’ve added an additional statement printing the value of the ret variable (supposed location of func return address, so this should print the address of the next instruction which will get executed after func returns from execution). </p> <p>Here is the dump which shows the supposed address of the instruction to be executed after func returns. (Underlined in green) As you can see, that value is way different from the value printed contained in the variable ret. </p> <p><a href="http://img717.imageshack.us/img717/8273/assemblycodecopy.png" rel="nofollow noreferrer">alt text http://img717.imageshack.us/img717/8273/assemblycodecopy.png</a></p> <p>My question is, why are they different? (of course in the assumption that what I’ve done are all correct). Else, what have I done wrong? Is my understanding of the program’s runtime stack wrong? Please, help me understand this. My project is due nextweek and I’ve barely touched it yet. I’m sorry if I’m being demanding, I badly need your help.</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USultrajohn
    1. USultrajohn
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POfunction's return address is different from its supposed value, buffer overflow, HELP PLEASE
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POfunction's return address is different from its supposed value, buffer overflow, HELP PLEASE
      1. This table or related slice is empty.
      1. VTDownMod
    3. VO
      singulars
      1. POfunction's return address is different from its supposed value, buffer overflow, HELP PLEASE
      1. This table or related slice is empty.
      1. VTUpMod
    1. COPlease include the text of your actual code (not just screen shots) in your posting.
      singulars
      1. POfunction's return address is different from its supposed value, buffer overflow, HELP PLEASE
      1. USR Samuel Klatchko
    2. COi'm sorry, but there's all there is.
      singulars
      1. POfunction's return address is different from its supposed value, buffer overflow, HELP PLEASE
      1. USultrajohn
    3. COi'm sorry please wait
      singulars
      1. POfunction's return address is different from its supposed value, buffer overflow, HELP PLEASE
      1. USultrajohn
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload