0

I am learning assembly and injections at the moment. Therefore I wrote a little program which simply prints out a hardcoded string. If I attach ollydbg to that I can inspect the executable I recognized that the offset in "PUSH OFFSET 00ABC154", which is my string I want to print, changes sometimes when I run the application multiple times.

Is it because my string stands in the data segment and the data segment isn't located every time at the same offset from the data segment? Or why does my offset change?

Improve this question
2
  • 1
    Probably ASLR..?
    – Sigtran
    Commented Jan 12, 2017 at 12:55
  • but why does the function I call with this parameter has the same offset every time then?
    – user7353965
    Commented Jan 12, 2017 at 19:07

1 Answer 1

Reset to default
1

It is due to ASLR like Sigtran said. As for your following question, it is the function's PLT that remains the same every time (I'm assuming you are talking about library function such as printf). The actual function address is resolved dynamically during the function's first invocation. The reason that the printf function's PLT remains the same is because it is in the text segment and the text segment is not randomized by ASLR.

P.S. I would have added this as comment to your question, but I don't have enough reputation :(

Improve this answer
2
  • Thank you for your answer :) And sorry for the late reply. May you answer me one more question please? What is about the offset of the operation "CALL DWORD". Does the offset of the call instruction change too or does it stay the same?
    – user7353965
    Commented Jan 19, 2017 at 10:18
  • It stays the same since the offset is to a function and the function is in the .text section, which is not randomized by ASLR.
    – yellowbyte
    Commented Jan 19, 2017 at 21:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.