0

I am learning assembly and injections at the moment. Therefore I wrote a little program which simply prints out a hardcoded string. If I attach ollydbg to that I can inspect the executable I recognized that the offset in "PUSH OFFSET 00ABC154", which is my string I want to print, changes sometimes when I run the application multiple times.

Is it because my string stands in the data segment and the data segment isn't located every time at the same offset from the data segment? Or why does my offset change?

2
  • 1
    Probably ASLR..? – Sigtran Jan 12 '17 at 12:55
  • but why does the function I call with this parameter has the same offset every time then? – user7353965 Jan 12 '17 at 19:07
1

It is due to ASLR like Sigtran said. As for your following question, it is the function's PLT that remains the same every time (I'm assuming you are talking about library function such as printf). The actual function address is resolved dynamically during the function's first invocation. The reason that the printf function's PLT remains the same is because it is in the text segment and the text segment is not randomized by ASLR.

P.S. I would have added this as comment to your question, but I don't have enough reputation :(

2
  • Thank you for your answer :) And sorry for the late reply. May you answer me one more question please? What is about the offset of the operation "CALL DWORD". Does the offset of the call instruction change too or does it stay the same? – user7353965 Jan 19 '17 at 10:18
  • It stays the same since the offset is to a function and the function is in the .text section, which is not randomized by ASLR. – yellowbyte Jan 19 '17 at 21:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.