1

While I was reversing an elf binary, I tried to manually compute my environment variable's address. Therefore I found this documentation and we're said that there is one NULL DWORD at the end of the stack.

In that case, the stack's binary isn't randomized, so there is a NULL DWORD at 0xbffffffc (0xc0000000 - 4). Then normally goes the program's name towards low addresses. So one would read into the stack:

./program_name\0 + NULL DWORD

But I'm finding two dwords when I check this out with gdb:

(gdb) x/4x 0xc0000000 - 0x10
0xbffffff0:     0x5f747365      0x00766e65      0x00000000      0x0000000

I can see that there's the end of my program name (plus the \0 as well) but shouldn't it end at 0xbffffffc instead of 0xbffffff8? There are two nul dwords instead of one, and I cannot understand why.

1

I don't know which architecture you are on, but the original documentation links to create_elf_tables in binfmt_elf.c.

In this function, you've got p = arch_align_stack(p);. The chinese documentation is obviously written for x86, but your architecture may use 8 bytes alignement for your stack, and pad with an extra DWORD.

0

Actually the architecture you're based on is important. In the given example, we were supposed that the binary was running on an x86 system. In my case, although it's been compiled with -m32, it's been run on an x64 system, thus aligning the stack with a QWORD, not a DWORD. This explains why there are "two DWORD" instead of one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.