0

I am learning exploitation from the book "Hacking: The Art of Exploitation". In the program an integer variable auth_flag is declared after a char array password_buffer. So on stack frame first password_buffer is pushed then auth_flag and address of auth_flag must be lower than that of password_buffer. But in GDB I am getting opposite result. Why is this happening?

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int check_authentication(char *password){
    char password_buffer[16];
    int auth_flag = 0;

    strcpy(password_buffer, password);

    if (strcmp(password_buffer, "brillig") == 0)
        auth_flag = 1;
    if (strcmp(password_buffer, "outgrabe") == 0)
        auth_flag = 1;

    return auth_flag;
}

int main(int argc, char *argv[]){
    if (argc < 2){
        printf("Usage: %s <password>\n", argv[0]);
        exit(0);
    }
    if (check_authentication(argv[1])){
        printf("\n===============================\n");
        printf("      Access Granted \n");
        printf("\n===============================\n");
    } else{
        printf("\nAccess Denied\n");
    }
}

GDB:

(gdb) x/s password_buffer 
0x7fffffffde60: "\001"
(gdb) x/x &auth_flag 
0x7fffffffde7c: 0x00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.