2

I am currently playing around with simple buffer overflows in a C program and I am trying to understand the program by stepping through it in IDA Pro.

The program takes an argument and writes it into a buffer with strcpy(). I can pass a simple argument like AAAA... to the program in IDA Pro (Debugger->process options) and see how the return address gets overwritten.

What I would like to do now is pass some shellcode as a parameter and see in IDA Pro how the program writes the shellcode in the buffer and overwrites the return address.

In a shell, I would execute something like:

$ ./vuln \`perl -e 'print "\x55\x89\xe5..."'`

or

$ ./vuln \`cat shellcode.txt`

So my question is: how can I pass non-printable characters as an argument to a program in IDA Pro?

  • Is it Linux or Windows ? Which debugger are you using ? – w s Nov 26 '15 at 8:55
  • Its a Linux system and i am using the built-in debugger of IDA. So my debugging process looks like this: opening the program "vuln" in IDA (File->open), Debugger->Process options enter "AAA..." in the field "Process parameters" then hit F9 to run it. – Jan Nov 26 '15 at 9:18
  • You can try and use a shellcode encoder like code.google.com/p/alpha3 to encode it in printable characters. – tmr232 Nov 27 '15 at 10:11
5

Try using IDC function StartDebugger. You can pass a C-style string (e.g. "\x55\x89\xe5")for program arguments:

***********************************************
** Launch the debugger
   arguments:
        path - path to the executable file.
        args - command line arguments
        sdir - initial directory for the process
for all args: if empty, the default value from the database will be used
   returns: -1-failed, 0-cancelled by the user, 1-ok
   See the important note to the StepInto() function

long StartDebugger(string path, string args, string sdir);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.