Questions tagged [stack]

Part of a process memory that stores all the automatic variables and the call-stack of the functions currently called by the process.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

Phoenix Exploit Education, Powershell script not working the error: '-netdev:user: invalid option','vmlinuz-4.9.0-8-amd64': No such file or directory

I tried these 2 scripts to set up phoenix from Exploit-Education but faced the below errors could not find any other script online one was from https://blog.lamarranet.com/index.php/exploit-education-...
user avatar
0 votes
0 answers
40 views

stack explanation from https://revers.engineering/applied-re-the-stack/

I've been reading [1] (By Daax Rynd) to get an understanding the stack and at around the 12th page, I'm a bit stumped by how the value 60 from sub rsp, 60 was arrived at. [Note, all code and quotes ...
user avatar
  • 125
0 votes
0 answers
81 views

How to resolve illegal instruction for this ARM stack exploitation?

Summary I am trying to write a stack overflow exploit for ARM Cortex-A72 running Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to the ARMv7 (32-bit) instruction set. I have ...
user avatar
1 vote
1 answer
33 views

Why struct allocation with new operator in local function makes additional space on stack?

I decided to ask the question on this forum because I can not figure out why struct allocation makes the additional 16 bytes space on local function stack(third line at the second snippet). Here is ...
user avatar
1 vote
0 answers
31 views

Call stack in Windbg address with no modules associated

I've been working on figuring out the stack from a minidump [1]; but have put that on hold as I had other things to figure out. Coming back to this problem, I figured I'd go back and use Windbg to ...
user avatar
  • 125
1 vote
1 answer
113 views

Understanding buffer overflow in Arm

Let's say I have a function (vuln) that has a local buffer with size of 0x20 bytes. In the beginning of this function, there is push r4-r7,lr. Is that correct, that the stack looks like: Buffer: (0x20)...
user avatar
  • 11
1 vote
1 answer
118 views

What is the structure of the Stack in a minidump?

I'm currently using Python3.9 in Linux to obtain the necessary information from a minidump file. I used WinDBG on my windows system to check whether the information I got was right. While [1], [2] ...
user avatar
  • 125
2 votes
1 answer
106 views

Radare2 does not reload payload correctly

I'm new to Radare2 so i'm trying to learn it by doing some basic buffer overflows. My problem is that, when i try to load some payloads, the stack seems to fake them in some differents ways... For ...
user avatar
0 votes
1 answer
44 views

troublesome stack frame setup

I have a function with the first few instructions defined as follows: sub rsp, 0x80 lea rbp, [rsp + 0x20] mov qword [rbp + 0x58], rsi mov qword [rbp + 0x50], rbx mov qword [rbp + 0x70], rcx mov ...
user avatar
  • 111
1 vote
1 answer
108 views

does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?

I am learning about windows x64 calling convention, where the first four arguments are passed to registers and left arguments are passed through the stack. To see it, I checked the assembly of the ...
user avatar
  • 25
0 votes
1 answer
84 views

Do Stack frames grow upwards?

I am currently learning RE and I came upon this piece of code which made me question whether stack frames grow upward: 0x080483f4 <main+0>: push ebp 0x080483f5 <main+1>: mov ...
user avatar
1 vote
1 answer
116 views

Analyze stack with IDAPython

In Ida pseudo-code when I press at stack's variable I can see the place of this variable in stack. char buffer[XXX]; // [sp+YYh] How can I get that information (buffer size and place of this buffer ...
user avatar
  • 33
1 vote
0 answers
28 views

Creating stack variables when they are addressed by non-SP register

So, I have ARM code which uses R7 as the register to access the stack variables: In the first basic block IDA successfully identified R7 as stack pointer and created the variables. But then, after ...
user avatar
  • 1,750
2 votes
0 answers
50 views

IDA stack depth differences when branching

I'm decompiling some Direct3D code that makes a lot of indirect calls to __stdcall functions. For example: call dword ptr [edx+0xC8h] which is really: pD3DDevice->SetRenderState(); IDA doesn't ...
user avatar
1 vote
2 answers
102 views

What is the state of the stack in the entry function?

I have an ELF binary and in the entry function the first two instructions are: XOR EBP, EBP POP ESI I'm curious what the state of the stack is at the start of the entry function in ELF and PE ...
user avatar
0 votes
2 answers
192 views

ASM Debuggers that visualize the stack (beginner friendly)

(Cross-posted from Stack Overflow) Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image: I use gdb for most ...
user avatar
  • 103
1 vote
1 answer
186 views

How to calculate value inside stack segment (SS)

I have an assembly row which the following information: EBP = 006FFB50 SS = 002B When I looked on this row: mov eax,dword ptr ss:[ebp+8] I assumed that EBP + 8 = 006FFB50 + 8 = 006FFB58. But ...
user avatar
  • 451
2 votes
2 answers
229 views

ASLR in Linux Vs Windows

I am quite new in binary exploitation. I am doing a lot of beginners exercise here. I am confused about ASLR. I tried some binary exploitation thing in Linux. It was recommended that I should stop ...
user avatar
3 votes
1 answer
134 views

reason of padding in exploit

I was doing vulnserver bufferflow exploit. I saw a tutorial where the he makes a payload to exploit the server. Take a look at the exploit: #!/usr/bin/python import socket target_ip = "10.0.2....
user avatar
1 vote
1 answer
635 views

Ghidra Decompiler Optimized Strings

Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so: If I try to set the type of puStack40 to char[38], I get the following ...
user avatar
4 votes
1 answer
177 views

Where do mouse/keyboard GUI inputs get queued or stored?

Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing? I'm wondering if it'd be possible ...
user avatar
1 vote
1 answer
52 views

Why does this x64 stack have other bytes and seems to be in reverse order?

I wrote the following small C program and you can also see the stack in the screenshot. My question is twofold: How come there are entire rows of other data between the 3 stack strings? Why is my ...
user avatar
  • 1,615
0 votes
0 answers
228 views

exploiting a binary using ret2libc

I ran into this binary at a CTF : https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
user avatar
0 votes
1 answer
161 views

x86 main preamble makes stack aligned on 32-bytes boundaries

For the record, I've read all stackexchange relevant answers on the topic (here and here) plus other articles to fully grasp the concepts of memory alignment and CPU natural boundaries. But for some ...
user avatar
0 votes
0 answers
53 views

How large are privileges of linux kernel module?

I know that kernel modules are practically part of the kernel since it gets loaded inside it. But I am not sure if it really gets all privileges the system has. Can it read/write code inside the ...
user avatar
3 votes
1 answer
240 views

Why EIP is being overwritten before local buffer ends?

I am doing a simple buffer overflow exercise, here is the source: //vuln.c #include <stdio.h> #include <string.h> int main(int argc, char* argv[]) { char buf[256]; strcpy(buf,...
user avatar
0 votes
0 answers
118 views

Bufferoverflow Stack

I want to do a buffer overflow exploit in the stack. For this i read in data via the "gets"-function. void ExploitMe() { char buffer[256]; gets(buffer); } I compile this file with gcc test.c -...
user avatar
  • 49
3 votes
1 answer
344 views

ELF x86 - Why is return address pushed twice?

I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there. main: lea ecx, [esp+0x4 {argc}] and esp, 0xfffffff0 ...
user avatar
  • 193
1 vote
1 answer
63 views

Find out if address store in heap or stack

While dynamic debugging with ida and gdb-server on binary file running on linux , I saw address that store some value. How can I know if this address allocated in stack or in heap?
user avatar
  • 503
1 vote
1 answer
315 views

radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char

Well, I've been digging around process command line arguments as well as environment variables a bit these last days, especially looking up the way main function arguments were pushed onto the stack. ...
user avatar
2 votes
1 answer
647 views

How to examine/edit stack memory contents using radare2 in debug mode?

How can i examine/edit stack contents using radare2, just like gdb ? Is there a way to examine memory using $rbp or $rsp register like below. x $rbp-10 <--- something like this which can dump from ...
user avatar
3 votes
1 answer
8k views

How to print the value of register with Radare 2

I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code. radare2 ch3.bin [0x080482f0]> aaa [[anal.jmptbl] Missing cjmp bb in ...
user avatar
  • 221
0 votes
1 answer
84 views

What is a good resource to learn about how the call stack works while programming in C?

Sorry if this is a duplicate and please point me in the right direction if so. I have a strong foundation in C programming and I know how memory is allocated on the stack for variables/arrays/...
user avatar
  • 385
2 votes
1 answer
1k views

Why stack canary can be brute-force one byte at a time?

I am reading brute-forcing stack canary. But I am confused why the server can be brute-forced one byte at a time on a crashable-server and what does mean this fork-and-accept ?
user avatar
  • 21
1 vote
2 answers
568 views

How to identify if buffer allocate on stack or heap?

When I looking on Ida with static analyze I see that buffer pass to function/ function fill data in buffer. How can I know if this buffer allocate in stack/ heap?
user avatar
  • 503
-2 votes
1 answer
1k views

Why dont use memcpy? [closed]

Why using memcpy can cause to stack overFlow? memcpy get the number of bytes to copy, so what is the problem , and how memcpy_s fix it?
user avatar
  • 503
1 vote
1 answer
264 views

Changing local variable in caller from callee in C? [closed]

I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
user avatar
  • 121
3 votes
2 answers
239 views

Remote Debugging Linux Binaries - Stack Address Changes?

Do stack addresses change every time we remotely debug a Linux binary using linux_server and IDA Pro? I am using IDA Pro and remote debug a linux binary which is running on a Linux machine and I am ...
user avatar
3 votes
2 answers
988 views

How to execute a specific shellcode with a non executable stack without using format string? (without ASLR and stack cookie)

First off we don't have ASLR and stack cookie, and assume we can't create our own files on this system So I'm trying to execute a shellcode in this code, this is what i have done so far: i have ...
user avatar
1 vote
1 answer
1k views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
user avatar
  • 197
-2 votes
1 answer
177 views

I have control to EIP but no have idea when put the shellcode - not have any dll return adress

for the practice i take some C code and compiled i try put shellcode open some calc and i not have idea which method i need to use #include <stdio.h> #include <string.h> int main(void) {...
user avatar
0 votes
1 answer
241 views

Why code subtracts 60 from esp when the length of the variable is 64

I was following a tutorial that introduced stack overflows. Here is the c Code. #include <stdlib.h> #include <unistd.h> #include <stdio.h> int main(int argc, char **argv) { ...
user avatar
  • 103
0 votes
1 answer
59 views

What is the difference between xrefs and stack trace?

In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace. What are the differences between them? How does IDA know what the stack ...
user avatar
3 votes
2 answers
334 views

Why doesn't this retn instruction return from the function?

I disassembled an exe file on Windows with IDA and saw this function prologue: I see that when the retn executes instead of returning it jumps to sub_1314cba4. Why doesn't the retn instruction ...
user avatar
4 votes
1 answer
4k views

Understanding Program Arguments on the Stack in Assembly

To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding ...
user avatar
  • 43
3 votes
1 answer
285 views

how to calculate max possible stack size utilization

Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython? currently my best approach is iterating through all functions and counting stack-...
user avatar
3 votes
0 answers
73 views

more memory allocated on the stack than seems to be needed [duplicate]

Im working on the bof challange in http://pwnable.kr/play.php. the source code has a function func: void func(int key){ char overflowme[32]; printf("overflow me : "); gets(overflowme); // ...
user avatar
-1 votes
1 answer
508 views

Which ARM command is influencing the SP position?

I do static analysis of ARM assembly code (I can't debug it). When I look on argument that in SP+0x<SomeOffset> I can find what I'm looking for, but if I look a few lines further down I see ...
user avatar
3 votes
1 answer
226 views

Basic hello world stack manipulation troubles

I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers". Here is the hello world program from the book (taken from chapter 3, page 12) : Now ...
user avatar
  • 261
4 votes
2 answers
519 views

Backtracing where a register gets initialized

I am currently trying to bypass a CRC check, that exists inline on many places in an application to check if memory pages in the .text section have been modified. Short explanation of the crc32 ...
user avatar
  • 43