1

Following a tutorial at http://www.fuzzysecurity.com/tutorials/expDev/2.html, regarding buffer overflows. I am able to execute the shellcode successfully. Used 'jmp esp' instead of 'pop esp; retn' as showed in tutorial.

Problem is, when I set breakpoint at the overwritten EIP address(I use 'jmp esp' from ntdll.dll) and try to step into(continously pressing F7), I run into access violation at 0x00443B46. If I try to see what is lying at this memory address, immunity can't find anything.

If after reaching breakpoint, I execute program(by pressing F9), or don't use breakpoints at all, everything works fine.

What does get changed by immunity while stepping, which leads to this error?

Update(23-Apr-2016) : I was just being specific about my steps, since using both instructions I am able to make the program jump to my NOP sled followed by the shellcode. Issue is, when I try to walkthrough the shellcode step by step(using F7), I run into 'access violation when writing to 0x00443B46'.

Either I use 'jmp esp' or 'pop esp; retn', it does not matter, problem is independent of this, because anyhow, both instruction executes properly and program proceeds further.

The only difference is, setting a breakpoint and proceeding step by step leads to this problem, and with no breakpoints, no problems.

  • 1
    "Used 'jmp esp' instead of 'pop esp; retn' as showed in tutorial." -- this sounds quite fishy to me. What exactly are you doing? I suspect you're jumping to some location directly "behind" the stack pointer, and when you do your F7 stepping, the debugger executes an INT 3 in each step, thus overwriting the stack, and with it, your memory location. But you'll have to improve your question and be much more specific to make it clear, if you want a helpful answer. – Guntram Blohm supports Monica Apr 16 '16 at 21:07
  • added some more explanation as an update – Nikhil Apr 23 '16 at 17:00
1

As @guntram-blohm suggested, "Used jmp esp instead of pop esp; retn" is likely a problem.

pop esp; retn effectively does the following, which is very different from jmp esp:

mov esp, dword ptr [esp]
jmp dword ptr [esp]
add esp, 4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.