0

Sorry if this is a duplicate and please point me in the right direction if so. I have a strong foundation in C programming and I know how memory is allocated on the stack for variables/arrays/pointers (of all datatypes) etc. I also understand how to use malloc and free to put data on the heap. What I do NOT understand is how all the registers and the call stack fit together with this picture and what each registers is supposed to point to. I am trying to learn this before I start messing with GDB so I actually know what I am looking at. Any good references out there?

Ultimately this is so I can do a project for my masters where I need to run shellcode by exploiting a buffer overflow vulnerability in a given program. I know how to do a basic buffer overflow by feeding the program more data than allocated but I don't know what/how much data I need to feed the program so that it gets put at the right place in memory in order to execute what is required.

1

What I do NOT understand is how all the registers and the call stack fit together with this picture and what each registers is supposed to point to.

It's great that you are competent in C, but there is no way around reading disassembled object code and writing assembly code (practical experience).

The compiler toolchain is responsible for generating object code that targets a particular CPU. This means that it is the compiler that is responsible for managing all of the registers based on details such as process layout in memory (which is OS-specific), calling convention, optimization level, application binary interface (also OS-specific), etc.

You did not give any information about the environment you are working in aside from mentioning GDB, so I am guessing you are going to be doing Linux x86 binary exploitation.

  • A good theoretical foundation for understanding the stack is provided by Chapter 8 "Subroutines and Control Abstraction" in Programming Language Pragmatics by Michael L. Scott.

  • A good practical introduction to Linux x86 stack structure and management is provided in section 3.7 "Procedures" in Computer Systems: A Programmer's Perspective by Bryant and O'Hallaron.

Lastly, there is the following Q&A regarding the stack over at the CS.SE site:

How are variables stored in and retrieved from the program stack?

  • Thanks @Julian. I appreciate it and will be diving into assembly. – will Jan 29 at 17:09
  • @user2976594 No problem, good luck – julian Jan 29 at 18:53
  • do you happen to have an IRC room you like to use? I could really use some help. What I am working on is relatively simple but I am stuck at one part and just need a nudge over the hump. But I feel stackexchange may not be the best forum. I did get the books you recommended though. – will Jan 30 at 2:16
  • @user2976594 you can create a chat room here, or DM me on twitter, or communicate via email – julian Jan 30 at 2:49
  • e-mail would work best can I PM you somehow so as not to publicly share my e-mail – will Jan 30 at 3:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.