I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.

While testing, I have noticed that if the program is run and the user selects option 4, then the program crashes with a segfault instead of exiting cleanly. Testing in GDB confirms that this happens during the "call exit" instruction at 0x08048954.

Reading the manpage for exit, I can see that undefined behaviour can occur in certain circumstances when functions are registered with atexit(3) or on_exit(3). However, I can't see any functions being registered in this way, and I can't see any other way which exit would fail to execute successfully. Why is a segfault happening during the exit call?

For reference, the surrounding code is:

push    offset aDonTGiveUp ; "Don't give up !"
call    puts
add     esp, 4
push    0
call    exit
push    offset aInvalidChoice ; "Invalid choice"
call    puts
add     esp, 4

Thank you for taking the time to read this.

  • I am not able to reproduce this on my system - Debian 9(stretch). One of the reason could be that the stack space might be exhausted. A register dump would be great in that case.However I don't see any recursive calls, are you sure the ELF is compatible with your loader and libc?
    – sudhackar
    Oct 17, 2019 at 3:56


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.