Did you notice that you indeed changed the desired variable?

You have changed the modified variable

Anyway, regarding the 2nd question, this is an intended behavior after the following pull-request was merged to radare2.

Now it is requires that you'll have 0x prefixed to the passed value, so you can do something like this:

wopO `dr ebp`

or something like that:

wopO `?v ebp`

The backticks are used to execute radare2 command so you basically use the result of the inner command and pass it to wopO

Regarding the first question, after some amount of chars (i.e long input) you'll get a Segfault, that's mean that your input cause a corruption and you indeed made a "damage" to eip. If you want to see how eip:

To disable it temporarily, execute:

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

And to enable it again, execute:

echo 2 | sudo tee /proc/sys/kernel/randomize_va_space

If you want to change the value permanently, say if it is an exploitation-dedicated machine, add the following setting to /etc/sysctl.conf, for example:

echo "kernel.randomize_va_space = 0" >> /etc/sysctl.conf

and run the sysctl -p command.

Did you notice that you indeed changed the desired variable?

You have changed the modified variable

Anyway, regarding the 2nd question, this is an intended behavior after the following pull-request was merged to radare2.

Now it is requires that you'll have 0x prefixed to the passed value, so you can do something like this:

wopO `dr ebp`

or something like that:

wopO `?v ebp`

The backticks are used to execute radare2 command so you basically use the result of the inner command and pass it to wopO

Regarding the first question, after some amount of chars (i.e long input) you'll get a Segfault, that's mean that your input cause a corruption and you indeed made a "damage" to eip. If you want to override eip you should bypass the security mitigation -- ASLR:

To disable it temporarily, execute:

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

And to enable it again, execute:

echo 2 | sudo tee /proc/sys/kernel/randomize_va_space

If you want to change the value permanently, say if it is an exploitation-dedicated machine, add the following setting to /etc/sysctl.conf, for example:

echo "kernel.randomize_va_space = 0" >> /etc/sysctl.conf

and run the sysctl -p command.

Did you notice that you indeed changed the desired variable?

You have changed the modified variable

Anyway, regarding the 2nd question, this is an intended behavior after the following pull-request was merged to radare2.

Now it is requires that you'll have 0x prefixed to the passed value, so you can do something like this:

wopO `dr ebp`

or something like that:

wopO `?v ebp`

The backticks are used to execute radare2 command so you basically use the result of the inner command and pass it to wopO

Regarding the first question, after some amount of chars (i.e long input) you'll get a Segfault, that's mean that your input cause a corruption and you indeed made a "damage" to eip. If you want to see how eip:

Tto disable it, execute:

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

And to enable it again, execute:

echo 2 | sudo tee /proc/sys/kernel/randomize_va_space

Did you notice that you indeed changed the desired variable?

You have changed the modified variable

Anyway, regarding the 2nd question, this is an intended behavior after the following pull-request was merged to radare2.

Now it is requires that you'll have 0x prefixed to the passed value, so you can do something like this:

wopO `dr ebp`

or something like that:

wopO `?v ebp`

The backticks are used to execute radare2 command so you basically use the result of the inner command and pass it to wopO

Regarding the first question, after some amount of chars (i.e long input) you'll get a Segfault, that's mean that your input cause a corruption and you indeed made a "damage" to eip. If you want to see how eip:

To disable it temporarily, execute:

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

And to enable it again, execute:

echo 2 | sudo tee /proc/sys/kernel/randomize_va_space

If you want to change the value permanently, say if it is an exploitation-dedicated machine, add the following setting to /etc/sysctl.conf, for example:

echo "kernel.randomize_va_space = 0" >> /etc/sysctl.conf

and run the sysctl -p command.