radare2- Unable to use wopO command

Question

I am new to radare2. I am trying out radare2 with exercise from Protostar stack0
I generate raw De Bruijn Patterns with below command

$ ragg2 -P 500 -r
AAABAACAADAAEAAFAAGAAHAAIAAJAAKAALAAMAANAAOAAPAAQAARAASAATAAUAAVAAWAAXAAYAAZAAaAAbAAcAAdAAeAAfAAgAAhAAiAAjAAkAAlAAmAAnAAoAApAAqAArAAsAAtAAuAAvAAwAAxAAyAAzAA1AA2AA3AA4AA5AA6AA7AA8AA9AA0ABBABCABDABEABFABGABHABIABJABKABLABMABNABOABPABQABRABSABTABUABVABWABXABYABZABaABbABcABdABeABfABgABhABiABjABkABlABmABnABoABpABqABrABsABtABuABvABwABxAByABzAB1AB2AB3AB4AB5AB6AB7AB8AB9AB0ACBACCACDACEACFACGACHACIACJACKACLACMACNACOACPACQACRACSACTACUACVACWACXACYACZACaACbACcACdACeACfACgAChACiACjACkAClACmACnACoACpACqACrACsA

Run the program in debug mode and execute it

$ r2 -d -A stack0
Process with PID 31611 started...
= attach 31611 31611
bin.baddr 0x08048000
Using 0x8048000
asm.bits 32
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze len bytes of instructions for references (aar)
[x] Analyze function calls (aac)
[x] Use -AA or aaaa to perform additional experimental analysis.
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
= attach 31611 31611
31611
 -- Buy a mac

[0xf7f72a20]> dc
AAABAACAADAAEAAFAAGAAHAAIAAJAAKAALAAMAANAAOAAPAAQAARAASAATAAUAAVAAWAAXAAYAAZAAaAAbAAcAAdAAeAAfAAgAAhAAiAAjAAkAAlAAmAAnAAoAApAAqAArAAsAAtAAuAAvAAwAAxAAyAAzAA1AA2AA3AA4AA5AA6AA7AA8AA9AA0ABBABCABDABEABFABGABHABIABJABKABLABMABNABOABPABQABRABSABTABUABVABWABXABYABZABaABbABcABdABeABfABgABhABiABjABkABlABmABnABoABpABqABrABsABtABuABvABwABxAByABzAB1AB2AB3AB4AB5AB6AB7AB8AB9AB0ACBACCACDACEACFACGACHACIACJACKACLACMACNACOACPACQACRACSACTACUACVACWACXACYACZACaACbACcACdACeACfACgAChACiACjACkAClACmACnACoACpACqACrACsA
You have changed the modified variable
child stopped with signal 11
[+] SIGNAL 11 errno=0 addr=0x4141583d code=1 ret=0

[0x080484d0]> dr
eax = 0x00000000
ebx = 0x5a414159
ecx = 0x41415841
edx = 0xf7f48870
esi = 0x00000001
edi = 0xf7f47000
esp = 0x4141583d
ebp = 0x41614141
eip = 0x080484d0
eflags = 0x00010282
oeax = 0xffffffff

[0x080484d0]> wopO ebp
Need hex value with `0x' prefix e.g. 0x41414142
[0x080484d0]> wopO esp
Need hex value with `0x' prefix e.g. 0x41414142
[0x080484d0]> wopO eip
Need hex value with `0x' prefix e.g. 0x41414142

Below is the C code which I am working on

  1 #include<stdio.h>
  2 #include<stdlib.h>
  3 #include<unistd.h>
  4
  5 int main(int argc, char **argv){
  6
  7     volatile int modified;
  8     char buffer[64];
  9
 10     modified = 0;
 11     scanf("%s",buffer);
 12
 13     if(modified !=0){
 14         printf("You have changed the modified variable\n");
 15     }else{
 16         printf("Try again\n");
 17     }
 18     return 0;
 19 }

Q1)Any reason why eip is not overwritten with the De Bruijn Pattern?

Q2)Why do I get the message Need hex value with '0x' prefix e.g. 0x41414142

Kindly let me know. Thank you.

Answer 1

Did you notice that you indeed changed the desired variable?

You have changed the modified variable

Anyway, regarding the 2nd question, this is an intended behavior after the following pull-request was merged to radare2.

Now it is requires that you'll have 0x prefixed to the passed value, so you can do something like this:

wopO `dr ebp`

or something like that:

wopO `?v ebp`

The backticks are used to execute radare2 command so you basically use the result of the inner command and pass it to wopO

---

Regarding the first question, after some amount of chars (i.e long input) you'll get a Segfault, that's mean that your input cause a corruption and you indeed made a "damage" to eip. If you want to override eip you should bypass the security mitigation -- ASLR:

To disable it temporarily, execute:

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

And to enable it again, execute:

echo 2 | sudo tee /proc/sys/kernel/randomize_va_space

If you want to change the value permanently, say if it is an exploitation-dedicated machine, add the following setting to /etc/sysctl.conf, for example:

echo "kernel.randomize_va_space = 0" >> /etc/sysctl.conf

and run the sysctl -p command.