I was trying out a simple heap overflow example (http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/) but replicated the relevant code in x86/x64 to understand it better. This is the code I used

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char *argv[])
    char *name = malloc(0x6);
    char *command = malloc(0x6);
    strcpy(name,"zzzzzzzzzzzzzzzzls -l");


I noticed that if I compiled the code and ran it normally, I will get system to execute "ls -l" and does a folder listing. However, if I was stepping through the binary using lldb from start to midway and proceed to continue the rest of the execution while inside lldb, I will see "whoami" executed instead.

I am testing this on a Mac OS and I am not sure if this is due to lldb or Mac OS behaviour?

  • Its possible that while debugging the heap chunks that get allocated are far apart or have some extra padding in between. Add printf("%p : %p\n", name, command) before strcpy to verify the addresses with and without debugger.
    – sudhackar
    Commented Oct 21, 2020 at 7:08
  • 1
    I’m voting to close this question because Its not related to RE in any way.
    – sudhackar
    Commented Oct 21, 2020 at 7:20
  • Thanks @sudhackar. Just curious though, my rationale for putting this in RE is because I was reversing it and the binary's behaviour looks different under lldb. Would it have been better if I posted this under Security Stack Exchange instead?
    – localacct
    Commented Oct 21, 2020 at 7:57
  • This was more of a "weird behaviour" question. Needs more looking around, not anything specific to RE.
    – sudhackar
    Commented Oct 21, 2020 at 8:04
  • Sorry just one more question. How did you know the exact difference was 0x10 (16 bytes)?
    – localacct
    Commented Oct 21, 2020 at 8:08

1 Answer 1


For the overflow from name to command to work, the difference between the addresses of both should be 0x10 bytes.

I verified what I mentioned in the case earlier - Adding

printf("%p:%p\n", name, command);

Under a debugger stepping through main gives the addresses as


Here delta > 0x10 bytes and hence the name strcpy would not overflow to command

while without stepping or without a debugger comes out


exactly 0x10 bytes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.