0

I was solving memory corruption CTF memory dump

In the picture you see a memory dump. I solve the problem when the string stored at addresses 2400, 2401... 2407 (in assembly it compares 8 memory addresses starting from 2400) matches the user entered string. The assembly code stores 0x0 at 2407 via 44ac: cf43 0700 mov.b #0x0, 0x7(r15) and r15 has value 2400.

When I entered the string 'pa+DAAc', it gets saved in memory (439c ...) and I am able to solve the problem. However, it says incorrect password when I enter 'pa+DAAc0' instead. This is because hexadecimal value of 0 is 0x30 which does not match 0x0 which is value at the address 2407.

QUESTION: Does the assembly code compare null character after user typed string with 0x0 at address 2407?

If yes, How can I explicitly enter that null character (pa+DAAc\x0 is not working)? If no, then what is it comparing 0x0 at 2407 with?

  • C strings are null-terminated by default. If you're trying to explicitly create a null character, have you tried \0? – Shane Reilly Sep 15 at 18:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.