I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.

While testing, I have noticed that if the program is run and the user selects option 4, then the program crashes with a segfault instead of exiting cleanly. Testing in GDB confirms that this happens during the "call exit" instruction at 0x08048954.

Reading the manpage for exit, I can see that undefined behaviour can occur in certain circumstances when functions are registered with atexit(3) or on_exit(3). However, I can't see any functions being registered in this way, and I can't see any other way which exit would fail to execute successfully. Why is a segfault happening during the exit call?

For reference, the surrounding code is:

push    offset aDonTGiveUp ; "Don't give up !"
call    puts
add     esp, 4
push    0
call    exit
push    offset aInvalidChoice ; "Invalid choice"
call    puts
add     esp, 4

Thank you for taking the time to read this.

  • I am not able to reproduce this on my system - Debian 9(stretch). One of the reason could be that the stack space might be exhausted. A register dump would be great in that case.However I don't see any recursive calls, are you sure the ELF is compatible with your loader and libc? – sudhackar Oct 17 '19 at 3:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.