1

I'm trying to exploit a buffer overflow vulnerability in an ARM64 program from this blog. When I give as input 100*'A', and I compile the program for ARM 32 bit (without canaries), the program crashes (as the return address is overwritten). But, when I give as input 100*'A', and I compile the program for ARM 64 bit (without canaries), the program does not crash. Why does it happen? Can someone explain?

Here are some screenshots of the stack before and after the call for strcpy:

32 bit: enter image description here 64 bit: enter image description here

BTW I'm using QEMU to run the code on an Ubuntu VM 64 bit on an Intel CPU (also tried with Kali Linux 64 bit).

Thanks.

The code is:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
void vulnerable(char* ip) {
    char buffer[20];
    strcpy(buffer, ip);
}
 
void win(){
    printf("You successfully exploited the buffer overflow\n");
    system("/bin/sh");
}

int main(int argc, char** argv) {
    if (argc != 2) {
        printf("Argument <input>\n");
        exit(1);
    }
    vulnerable(argv[1]);
    exit(0);
}

Compiled with:

aarch64-linux-gnu-gcc -O0 -fno-stack-protector -z execstack -o vuln64 ./vuln.c
7
  • what happens if you enter 200 characters?
    – Igor Skochinsky
    Dec 4, 2023 at 23:06
  • 1
    Same, no crash, for larger inputs as well
    – alond22
    Dec 6, 2023 at 14:47
  • It seem that the buffer overflow is meant for the ARM64 and not for Intel, so why do you expect this to work on your Intel?
    – not2qubit
    Dec 6, 2023 at 18:27
  • Also try compile with: -fPIE -pie.
    – not2qubit
    Dec 6, 2023 at 18:42
  • Thank you for the response. (1) Why wouldn't it work? The emulated (ARM) process also has a stack, the stack keeps the return address, and if you overflow the buffer and overrun the return address - the process will jump to that modified address address (2) It worked for a 32-bit ARM binary with QEMU emulation on an Intel CPU (3) -fPIE -pie did not help
    – alond22
    Dec 7, 2023 at 20:32

1 Answer 1

1

The return address has been placed below the buffer on the stack. I presume it's the 0x55000008e0 entry in your second screenshot. This means that you won't be able to overwrite the return address via the buffer overflow.

See https://stackoverflow.com/questions/68774522/arm64-buffer-overflow-cannot-overwrite-pc for a more detailed explanation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.