Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [stack]

Part of a process memory that stores all the automatic variables and the call-stack of the functions currently called by the process.

-2
votes
0answers
66 views

Randomly generated stack canary [on hold]

I have two binaries that are 32 and 64 bit. I am working on Virtual ubuntu 18.04 on a x86-64 architecture. I am trying to bypass randomly generated stack canary. Is there any reliable source where I ...
-2
votes
1answer
44 views

Why dont use memcpy? [closed]

Why using memcpy can cause to stack overFlow? memcpy get the number of bytes to copy, so what is the problem , and how memcpy_s fix it?
0
votes
1answer
70 views

Changing local variable in caller from callee in C?

I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
2
votes
2answers
106 views

Remote Debugging Linux Binaries - Stack Address Changes?

Do stack addresses change every time we remotely debug a Linux binary using linux_server and IDA Pro? I am using IDA Pro and remote debug a linux binary which is running on a Linux machine and I am ...
3
votes
2answers
100 views

How to execute a specific shellcode with a non executable stack without using format string? (without ASLR and stack cookie)

First off we don't have ASLR and stack cookie, and assume we can't create our own files on this system So I'm trying to execute a shellcode in this code, this is what i have done so far: i have ...
1
vote
1answer
68 views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
0
votes
0answers
39 views

A question about stack frame

I have register ebp+0x8 : 0xb3fb1998 So ebp+0xa is 0x19 right ? Im newbie and I'm sorry for my bad English.
-2
votes
1answer
83 views

I have control to EIP but no have idea when put the shellcode - not have any dll return adress

for the practice i take some C code and compiled i try put shellcode open some calc and i not have idea which method i need to use #include <stdio.h> #include <string.h> int main(void) ...
0
votes
1answer
55 views

Why code subtracts 60 from esp when the length of the variable is 64

I was following a tutorial that introduced stack overflows. Here is the c Code. #include <stdlib.h> #include <unistd.h> #include <stdio.h> int main(int argc, char **argv) { ...
0
votes
1answer
31 views

What is the difference between xrefs and stack trace?

In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace. What are the differences between them? How does IDA know what the stack ...
3
votes
2answers
120 views

Why doesn't this retn instruction return from the function?

I disassembled an exe file on Windows with IDA and saw this function prologue: I see that when the retn executes instead of returning it jumps to sub_1314cba4. Why doesn't the retn instruction ...
3
votes
1answer
369 views

Understanding Program Arguments on the Stack in Assembly

To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding ...
3
votes
0answers
67 views

how to calculate max possible stack size utilization

Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython? currently my best approach is iterating through all functions and counting stack-...
3
votes
0answers
64 views

more memory allocated on the stack than seems to be needed [duplicate]

Im working on the bof challange in http://pwnable.kr/play.php. the source code has a function func: void func(int key){ char overflowme[32]; printf("overflow me : "); gets(overflowme); // ...
-1
votes
1answer
51 views

Which ARM command is influencing the SP position?

I do static analysis of ARM assembly code (I can't debug it). When I look on argument that in SP+0x<SomeOffset> I can find what I'm looking for, but if I look a few lines further down I see ...
3
votes
1answer
100 views

Basic hello world stack manipulation troubles

I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers". Here is the hello world program from the book (taken from chapter 3, page 12) : Now ...
4
votes
2answers
155 views

Backtracing where a register gets initialized

I am currently trying to bypass a CRC check, that exists inline on many places in an application to check if memory pages in the .text section have been modified. Short explanation of the crc32 ...
1
vote
1answer
140 views

How is data transferred from the process’ memory to the console screen?

I am learning about how the call stack works by reverse engineering binaries using Radare2 (in a Linux environment). The ISA on the server (a P5 micro-architecture) I am analyzing binaries off of is ...
2
votes
1answer
133 views

IDA makes an incorrect guess about how a virtual function affects the stack. How can I correct/override it?

So this may be a weird question. I'm working with a windows 32-bit executable in IDA that was originally programmed in C/C++ (Mostly likely with Visual Studio .NET 2002). For the virtual function ...
2
votes
1answer
85 views

ARM system crashes after changing stack address

-- Edit with latest update on the problem, it is not solved yet :( -- While playing with an ARM embedded Linux system (Version 3.8.13), out of curiosity, I created a small "debug" kernel module. ...
2
votes
2answers
51 views

Can we see local variable directly by inspecting the disk image (file in disk)?

As far as I know, global and static variables are stored in heap memory, while local variables are on stack memory. I think this is the case when we speak about a binary file (like PE) that is located ...
1
vote
0answers
422 views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
1
vote
0answers
150 views

Fixing '__asm' in pseudocode in IDA PRO (inconsistent fpu stack error)

So I was doing some REing in IDA, changed a function parameter type and suddenly my stack pointer messes up (1025B361: inconsistent fpu stack). Does anyone know what to look for here or how to fix it? ...
0
votes
2answers
308 views

Understanding the output of Windbg's `dds esp`

I am not sure if I am understanding the raw output of dds esp or its 64-bit counterpart dqs rsp properly. When I see a list of entries in the stack, I tend to assume that wherever I see return ...
3
votes
2answers
492 views

What could be the purpose of XORing esp with a global variable? (stack canary protection)

I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
1
vote
1answer
304 views

ESP out of range of “Stack View” in IDA

A very similar (or exact) question was asked here, though it was not answered properly. I am debugging a process in IDA and am unable to view the dynamic contents of the stack because its value ...
6
votes
3answers
1k views

Is there any tool to visually see program stack in linux while debugging?

By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
0
votes
1answer
41 views

What additional data does a compiler populate the buffer space with? [duplicate]

I am currently learning about the stack, in particular how to perform stack overflow attacks. I understand that the buffer is not the size that the program initially set it as, for example if we ...
3
votes
2answers
147 views

Two arguments pushed on stack, callee only shows one argument

I have found myself confused while reversing some programs (specifically the IOLI Crackme challenges). I have no trouble solving them, but I have come across something that I do not understand and it ...
0
votes
1answer
115 views

whats the purpose of this code snippet?

I'm using at&t ordering I came across this a little while ago and while i understand why we want to push a stack frame when we call a new routine I don't see why it was done here: (for the ...
0
votes
1answer
123 views

Is stack migration a standard attack technique?

I am reading up a writeup on an example attack here where I have come across the technique called stack migration. The page is translated to English. Googling doesn't give me any fruitful pointer on ...
1
vote
0answers
399 views

How can I control local variable ordering on stack in gcc?

I am writing a reversing challenge where I need to seed a bug. It's important to have a particular ordering of local variable on stack in a method. However, gcc seems to shuffle those around. How can ...
4
votes
1answer
673 views

How to find the stack and other info in a memory dump? ARM

I'm reversing a closed platform to try gain execution using an exploit, a stack overflow. I've been told that (since there are no debuggers) the best way is to use RAM dumps (that I have) to try ...
1
vote
1answer
2k views

Passing argument through registers instead of the stack

I'm learning (and re-learning) C and assembly, and I came across a difference between what I've been taught and the actual result I have. Some code: int test(int a, int b){ return a + b; } int ...
2
votes
1answer
202 views

Stack variable information removed in IDA pro (free version)?

I'm using the IDApro free version and I was wondering why sometimes there could be a instruction like... mov [esp + 1140h + var_1234], ebx and if you click inside the bracket, and hit the letter K (...
1
vote
1answer
287 views

Moving xmm0 onto the stack results in a access violation exception

Reversing an application that crashes at the last line of the following instructions: sub rsp,68 mov qword ptr ss:[rsp+B0],rcx mov qword ptr ss:[rsp+B8],rdx mov qword ptr ss:[rsp+C0],r8 mov qword ptr ...
1
vote
1answer
82 views

Function is returning to somewhere in stack

I'm trying to hook this 'recv callback' function and can manage to hook the function. However, when the 'new function' is supposed to return to its caller, it's instead returning to somewhere in stack,...
3
votes
2answers
1k views

Extracting threads' stack from Windows memory dump

I have a memory dump of a VM running Windows server 2012 R2. The dump is of the entire RAM (4 GB). I want to extract as many features as possible from this dump. Mainly I want to extract all stacks ...
-1
votes
1answer
444 views

Stack smashing in X86_64 leads to Segmentation fault .

I been trying to smash the stack in an x86_64 machine , the payload gets executed when I use a debugger (gdb) and fails with Segmentation fault when I run it normally Here is the vulnerable program ...
0
votes
0answers
337 views

Debugger stack overflow

I'm having weird issue with debugging. No matter which software I use: IDA or even Cheat Engine, the debugger crashes on resuming from breakpoint with error: 7716DF76: A new guard page for the stack ...
0
votes
1answer
140 views

Are arguments of the called function part of its stack frame in Intel x86?

Hi everyone and sorry for the silly question. Let's say that "main" calls an "add" function (pseudocode): main { add(5,10) } The stack would be something similar: ...main... | 10 | | 05 | | ...
3
votes
1answer
1k views

Writing an exploit for sample-application

I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application: #include <stdio.h> #include &...
1
vote
1answer
2k views

Can mprotect set the stack itself as executable?

I'm taking my first steps in memory exploitation in Linux. I'm following a tutorial for a practice VM($ uname -r -> 3.13.0-32-generic) The tutorial makes a call to mprotect to set a certain region ...
1
vote
2answers
6k views

Return address on ESP?

I've read that the return address of a function call is always pushed on the ESP stack. But the thing when i tried to see that using gdb, I didn't find it. Here's the program written in C I've used : ...
1
vote
1answer
123 views

How do I found out what register used for stack pointer on RISC architectures?

On some RISC architectures there's no notion of stack pointer register - there's some register, used to hold a stack pointer and address of the stack frame, but nowhere told explicitly what. So, how ...
3
votes
1answer
394 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
3
votes
1answer
4k views

How to make stack variables into an array in IDA Pro

I've got a procedure in IDA Pro with a few local stack variables, but part of them belong to an array. I would like to define the array, but pressing * (Create Array) fails, and pressing Y (Set Type) ...
1
vote
2answers
89 views

ELF File format Two terminating null dword towards 0xc0000000?

While I was reversing an elf binary, I tried to manually compute my environment variable's address. Therefore I found this documentation and we're said that there is one NULL DWORD at the end of the ...
6
votes
1answer
805 views

Segmentation on x86 for stack canaries

I just compiled some C code that reads in input using gets and disassembled the code. The platform is Ubuntu 32-bit. There are these 3 lines that check if the canary value has been tampered with. ...
0
votes
1answer
464 views

Dump the stack in Ollydbg

Is there a way to dump the stack of a program while debugging in ollydbg and store the result in a file ?