2

I was trying out a simple heap overflow example (http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/) but replicated the relevant code in x86/x64 to understand it better. This is the code I used

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char *argv[])
{
    char *name = malloc(0x6);
    char *command = malloc(0x6);
    strcpy(command,"whoami");
    strcpy(name,"zzzzzzzzzzzzzzzzls -l");

    system(command);
}

I noticed that if I compiled the code and ran it normally, I will get system to execute "ls -l" and does a folder listing. However, if I was stepping through the binary using lldb from start to midway and proceed to continue the rest of the execution while inside lldb, I will see "whoami" executed instead.

I am testing this on a Mac OS and I am not sure if this is due to lldb or Mac OS behaviour?

6
  • Its possible that while debugging the heap chunks that get allocated are far apart or have some extra padding in between. Add printf("%p : %p\n", name, command) before strcpy to verify the addresses with and without debugger. – sudhackar Oct 21 '20 at 7:08
  • 1
    I’m voting to close this question because Its not related to RE in any way. – sudhackar Oct 21 '20 at 7:20
  • Thanks @sudhackar. Just curious though, my rationale for putting this in RE is because I was reversing it and the binary's behaviour looks different under lldb. Would it have been better if I posted this under Security Stack Exchange instead? – localacct Oct 21 '20 at 7:57
  • This was more of a "weird behaviour" question. Needs more looking around, not anything specific to RE. – sudhackar Oct 21 '20 at 8:04
  • Sorry just one more question. How did you know the exact difference was 0x10 (16 bytes)? – localacct Oct 21 '20 at 8:08
2

For the overflow from name to command to work, the difference between the addresses of both should be 0x10 bytes.

I verified what I mentioned in the case earlier - Adding

printf("%p:%p\n", name, command);

Under a debugger stepping through main gives the addresses as

0x100404080:0x1002059f0

Here delta > 0x10 bytes and hence the name strcpy would not overflow to command

while without stepping or without a debugger comes out

0x7fa890405830:0x7fa890405840

exactly 0x10 bytes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.