3

I was trying out a ROP exploit -- I'm trying to make an mprotect system call using ROP(not a libc call), to try and make the buffer executable. I tried stracing the server process and ran the exploit, only to see that results in an error as follows :-

mprotect(0xbffdda10, 65536, PROT_READ|PROT_WRITE|PROT_EXEC) = -1 EINVAL(Invalid argument)

Later on, I tried a different address 0x08048000 and I could see that the call worked(strace output and /proc/pid/maps confirms this). Given a buffer address how could I guess/find the correct page address that I could use to make a call to mprotect.

I think I figured out the reason why this happens. ASLR is enabled and the page that starts at 0x08048000 does not change addresses. However, the page that corresponds to the buffer changes addresses. The buffer address can be leaked -- so I tried checking if the difference between the start of the page and the buffer address remains constant, it does not.

2

I'm not sure, but you probably experiencing the following issue: Usually page addresses are rounded by page size. It depends on page size in system you working with. So you can calculate this address by making AND operation with constant ~(PAGE_SIZE-1).

If it doesn't work, try to call call mprotect twice:

  1. first do read and write without execute,
  2. change the memory, and after that call mprotect with execute bit but without write bit.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy