1

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.

While testing, I have noticed that if the program is run and the user selects option 4, then the program crashes with a segfault instead of exiting cleanly. Testing in GDB confirms that this happens during the "call exit" instruction at 0x08048954.

Reading the manpage for exit, I can see that undefined behaviour can occur in certain circumstances when functions are registered with atexit(3) or on_exit(3). However, I can't see any functions being registered in this way, and I can't see any other way which exit would fail to execute successfully. Why is a segfault happening during the exit call?

For reference, the surrounding code is:

0x080489F1: 
push    offset aDonTGiveUp ; "Don't give up !"
call    puts
add     esp, 4
push    0
call    exit
push    offset aInvalidChoice ; "Invalid choice"
call    puts
add     esp, 4
nop

Thank you for taking the time to read this.

|improve this question

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.