2

I am currently playing around with simple buffer overflows in a C program and I am trying to understand the program by stepping through it in IDA Pro.

The program takes an argument and writes it into a buffer with strcpy(). I can pass a simple argument like AAAA... to the program in IDA Pro (Debugger->process options) and see how the return address gets overwritten.

What I would like to do now is pass some shellcode as a parameter and see in IDA Pro how the program writes the shellcode in the buffer and overwrites the return address.

In a shell, I would execute something like:

$ ./vuln \`perl -e 'print "\x55\x89\xe5..."'`

or

$ ./vuln \`cat shellcode.txt`

So my question is: how can I pass non-printable characters as an argument to a program in IDA Pro?

3
  • Is it Linux or Windows ? Which debugger are you using ?
    – w s
    Commented Nov 26, 2015 at 8:55
  • Its a Linux system and i am using the built-in debugger of IDA. So my debugging process looks like this: opening the program "vuln" in IDA (File->open), Debugger->Process options enter "AAA..." in the field "Process parameters" then hit F9 to run it.
    – Jan
    Commented Nov 26, 2015 at 9:18
  • You can try and use a shellcode encoder like code.google.com/p/alpha3 to encode it in printable characters.
    – tmr232
    Commented Nov 27, 2015 at 10:11

1 Answer 1

6

Try using IDC function StartDebugger. You can pass a C-style string (e.g. "\x55\x89\xe5")for program arguments:

***********************************************
** Launch the debugger
   arguments:
        path - path to the executable file.
        args - command line arguments
        sdir - initial directory for the process
for all args: if empty, the default value from the database will be used
   returns: -1-failed, 0-cancelled by the user, 1-ok
   See the important note to the StepInto() function

long StartDebugger(string path, string args, string sdir);
2
  • when I start debuuger using following command idc.StartDebugger("/root/Documents/remote_debug/heapoverflow", "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0001020304\x92\x91\x04\x08", "") IDA places hex charcters EFBDBFEF instead of that particular address
    – Infinity
    Commented Dec 27, 2019 at 6:15
  • I am using remote debugging
    – Infinity
    Commented Dec 27, 2019 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.