Questions tagged [stack]

Part of a process memory that stores all the automatic variables and the call-stack of the functions currently called by the process.

Filter by
Sorted by
Tagged with
3
votes
1answer
157 views

ELF x86 - Why is return address pushed twice?

I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there. main: lea ecx, [esp+0x4 {argc}] and esp, 0xfffffff0 ...
1
vote
1answer
38 views

Find out if address store in heap or stack

While dynamic debugging with ida and gdb-server on binary file running on linux , I saw address that store some value. How can I know if this address allocated in stack or in heap?
1
vote
1answer
60 views

radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char

Well, I've been digging around process command line arguments as well as environment variables a bit these last days, especially looking up the way main function arguments were pushed onto the stack. ...
2
votes
1answer
58 views

How to examine/edit stack memory contents using radare2 in debug mode?

How can i examine/edit stack contents using radare2, just like gdb ? Is there a way to examine memory using $rbp or $rsp register like below. x $rbp-10 <--- something like this which can dump from ...
0
votes
0answers
18 views

Stack trace with GdbServer

When I debug binary file on linux with gdbServer with Ida ,I don't see stack trace. Why? How can I fix it to see stack trace??
0
votes
1answer
722 views

How to print the value of register with Radare 2

I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code. radare2 ch3.bin [0x080482f0]> aaa [[anal.jmptbl] Missing cjmp bb in ...
0
votes
1answer
60 views

What is a good resource to learn about how the call stack works while programming in C?

Sorry if this is a duplicate and please point me in the right direction if so. I have a strong foundation in C programming and I know how memory is allocated on the stack for variables/arrays/...
2
votes
1answer
226 views

Why stack canary can be brute-force one byte at a time?

I am reading brute-forcing stack canary. But I am confused why the server can be brute-forced one byte at a time on a crashable-server and what does mean this fork-and-accept ?
1
vote
2answers
152 views

How to identify if buffer allocate on stack or heap?

When I looking on Ida with static analyze I see that buffer pass to function/ function fill data in buffer. How can I know if this buffer allocate in stack/ heap?
-2
votes
1answer
164 views

Why dont use memcpy? [closed]

Why using memcpy can cause to stack overFlow? memcpy get the number of bytes to copy, so what is the problem , and how memcpy_s fix it?
0
votes
1answer
110 views

Changing local variable in caller from callee in C?

I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
3
votes
2answers
154 views

Remote Debugging Linux Binaries - Stack Address Changes?

Do stack addresses change every time we remotely debug a Linux binary using linux_server and IDA Pro? I am using IDA Pro and remote debug a linux binary which is running on a Linux machine and I am ...
3
votes
2answers
313 views

How to execute a specific shellcode with a non executable stack without using format string? (without ASLR and stack cookie)

First off we don't have ASLR and stack cookie, and assume we can't create our own files on this system So I'm trying to execute a shellcode in this code, this is what i have done so far: i have ...
1
vote
1answer
181 views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
-2
votes
1answer
102 views

I have control to EIP but no have idea when put the shellcode - not have any dll return adress

for the practice i take some C code and compiled i try put shellcode open some calc and i not have idea which method i need to use #include <stdio.h> #include <string.h> int main(void) ...
0
votes
1answer
65 views

Why code subtracts 60 from esp when the length of the variable is 64

I was following a tutorial that introduced stack overflows. Here is the c Code. #include <stdlib.h> #include <unistd.h> #include <stdio.h> int main(int argc, char **argv) { ...
0
votes
1answer
34 views

What is the difference between xrefs and stack trace?

In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace. What are the differences between them? How does IDA know what the stack ...
3
votes
2answers
154 views

Why doesn't this retn instruction return from the function?

I disassembled an exe file on Windows with IDA and saw this function prologue: I see that when the retn executes instead of returning it jumps to sub_1314cba4. Why doesn't the retn instruction ...
3
votes
1answer
1k views

Understanding Program Arguments on the Stack in Assembly

To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding ...
3
votes
0answers
118 views

how to calculate max possible stack size utilization

Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython? currently my best approach is iterating through all functions and counting stack-...
3
votes
0answers
68 views

more memory allocated on the stack than seems to be needed [duplicate]

Im working on the bof challange in http://pwnable.kr/play.php. the source code has a function func: void func(int key){ char overflowme[32]; printf("overflow me : "); gets(overflowme); // ...
-1
votes
1answer
80 views

Which ARM command is influencing the SP position?

I do static analysis of ARM assembly code (I can't debug it). When I look on argument that in SP+0x<SomeOffset> I can find what I'm looking for, but if I look a few lines further down I see ...
3
votes
1answer
122 views

Basic hello world stack manipulation troubles

I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers". Here is the hello world program from the book (taken from chapter 3, page 12) : Now ...
4
votes
2answers
187 views

Backtracing where a register gets initialized

I am currently trying to bypass a CRC check, that exists inline on many places in an application to check if memory pages in the .text section have been modified. Short explanation of the crc32 ...
1
vote
1answer
146 views

How is data transferred from the process’ memory to the console screen?

I am learning about how the call stack works by reverse engineering binaries using Radare2 (in a Linux environment). The ISA on the server (a P5 micro-architecture) I am analyzing binaries off of is ...
2
votes
1answer
185 views

IDA makes an incorrect guess about how a virtual function affects the stack. How can I correct/override it?

So this may be a weird question. I'm working with a windows 32-bit executable in IDA that was originally programmed in C/C++ (Mostly likely with Visual Studio .NET 2002). For the virtual function ...
2
votes
1answer
98 views

ARM system crashes after changing stack address

-- Edit with latest update on the problem, it is not solved yet :( -- While playing with an ARM embedded Linux system (Version 3.8.13), out of curiosity, I created a small "debug" kernel module. ...
2
votes
2answers
61 views

Can we see local variable directly by inspecting the disk image (file in disk)?

As far as I know, global and static variables are stored in heap memory, while local variables are on stack memory. I think this is the case when we speak about a binary file (like PE) that is located ...
1
vote
0answers
546 views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
1
vote
0answers
241 views

Fixing '__asm' in pseudocode in IDA PRO (inconsistent fpu stack error)

So I was doing some REing in IDA, changed a function parameter type and suddenly my stack pointer messes up (1025B361: inconsistent fpu stack). Does anyone know what to look for here or how to fix it? ...
0
votes
2answers
450 views

Understanding the output of Windbg's `dds esp`

I am not sure if I am understanding the raw output of dds esp or its 64-bit counterpart dqs rsp properly. When I see a list of entries in the stack, I tend to assume that wherever I see return ...
4
votes
2answers
877 views

What could be the purpose of XORing esp with a global variable? (stack canary protection)

I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
1
vote
1answer
400 views

ESP out of range of “Stack View” in IDA

A very similar (or exact) question was asked here, though it was not answered properly. I am debugging a process in IDA and am unable to view the dynamic contents of the stack because its value ...
5
votes
3answers
2k views

Is there any tool to visually see program stack in linux while debugging?

By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
0
votes
1answer
43 views

What additional data does a compiler populate the buffer space with? [duplicate]

I am currently learning about the stack, in particular how to perform stack overflow attacks. I understand that the buffer is not the size that the program initially set it as, for example if we ...
2
votes
2answers
157 views

Two arguments pushed on stack, callee only shows one argument

I have found myself confused while reversing some programs (specifically the IOLI Crackme challenges). I have no trouble solving them, but I have come across something that I do not understand and it ...
0
votes
1answer
121 views

whats the purpose of this code snippet?

I'm using at&t ordering I came across this a little while ago and while i understand why we want to push a stack frame when we call a new routine I don't see why it was done here: (for the ...
0
votes
1answer
130 views

Is stack migration a standard attack technique?

I am reading up a writeup on an example attack here where I have come across the technique called stack migration. The page is translated to English. Googling doesn't give me any fruitful pointer on ...
1
vote
0answers
474 views

How can I control local variable ordering on stack in gcc?

I am writing a reversing challenge where I need to seed a bug. It's important to have a particular ordering of local variable on stack in a method. However, gcc seems to shuffle those around. How can ...
4
votes
1answer
788 views

How to find the stack and other info in a memory dump? ARM

I'm reversing a closed platform to try gain execution using an exploit, a stack overflow. I've been told that (since there are no debuggers) the best way is to use RAM dumps (that I have) to try ...
1
vote
1answer
2k views

Passing argument through registers instead of the stack

I'm learning (and re-learning) C and assembly, and I came across a difference between what I've been taught and the actual result I have. Some code: int test(int a, int b){ return a + b; } int ...
2
votes
1answer
244 views

Stack variable information removed in IDA pro (free version)?

I'm using the IDApro free version and I was wondering why sometimes there could be a instruction like... mov [esp + 1140h + var_1234], ebx and if you click inside the bracket, and hit the letter K (...
1
vote
1answer
447 views

Moving xmm0 onto the stack results in a access violation exception

Reversing an application that crashes at the last line of the following instructions: sub rsp,68 mov qword ptr ss:[rsp+B0],rcx mov qword ptr ss:[rsp+B8],rdx mov qword ptr ss:[rsp+C0],r8 mov qword ptr ...
1
vote
1answer
84 views

Function is returning to somewhere in stack

I'm trying to hook this 'recv callback' function and can manage to hook the function. However, when the 'new function' is supposed to return to its caller, it's instead returning to somewhere in stack,...
3
votes
2answers
1k views

Extracting threads' stack from Windows memory dump

I have a memory dump of a VM running Windows server 2012 R2. The dump is of the entire RAM (4 GB). I want to extract as many features as possible from this dump. Mainly I want to extract all stacks ...
-1
votes
1answer
563 views

Stack smashing in X86_64 leads to Segmentation fault .

I been trying to smash the stack in an x86_64 machine , the payload gets executed when I use a debugger (gdb) and fails with Segmentation fault when I run it normally Here is the vulnerable program ...
0
votes
1answer
161 views

Are arguments of the called function part of its stack frame in Intel x86?

Hi everyone and sorry for the silly question. Let's say that "main" calls an "add" function (pseudocode): main { add(5,10) } The stack would be something similar: ...main... | 10 | | 05 | | ...
5
votes
1answer
2k views

Writing an exploit for sample-application

I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application: #include <stdio.h> #include &...
1
vote
1answer
3k views

Can mprotect set the stack itself as executable?

I'm taking my first steps in memory exploitation in Linux. I'm following a tutorial for a practice VM($ uname -r -> 3.13.0-32-generic) The tutorial makes a call to mprotect to set a certain region ...
1
vote
2answers
8k views

Return address on ESP?

I've read that the return address of a function call is always pushed on the ESP stack. But the thing when i tried to see that using gdb, I didn't find it. Here's the program written in C I've used : ...