Questions tagged [stack]

Part of a process memory that stores all the automatic variables and the call-stack of the functions currently called by the process.

Filter by
Sorted by
Tagged with
4 votes
2 answers
2k views

What could be the purpose of XORing esp with a global variable? (stack canary protection)

I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
InkassoHeinzi's user avatar
3 votes
1 answer
745 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
Vlad's user avatar
  • 139
2 votes
1 answer
651 views

Stack variable information removed in IDA pro (free version)?

I'm using the IDApro free version and I was wondering why sometimes there could be a instruction like... mov [esp + 1140h + var_1234], ebx and if you click inside the bracket, and hit the letter K (...
Arrow's user avatar
  • 123
1 vote
1 answer
1k views

ESP out of range of "Stack View" in IDA

A very similar (or exact) question was asked here, though it was not answered properly. I am debugging a process in IDA and am unable to view the dynamic contents of the stack because its value ...
sherrellbc's user avatar
8 votes
3 answers
7k views

Is there any tool to visually see program stack in linux while debugging?

By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
pizzaEatingGuy's user avatar
6 votes
1 answer
2k views

Segmentation on x86 for stack canaries

I just compiled some C code that reads in input using gets and disassembled the code. The platform is Ubuntu 32-bit. There are these 3 lines that check if the canary value has been tampered with. ...
user avatar
5 votes
1 answer
3k views

Writing an exploit for sample-application

I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application: #include <stdio.h> #include &...
JDoens's user avatar
  • 63
4 votes
2 answers
680 views

Backtracing where a register gets initialized

I am currently trying to bypass a CRC check, that exists inline on many places in an application to check if memory pages in the .text section have been modified. Short explanation of the crc32 ...
Lyan's user avatar
  • 43
3 votes
1 answer
446 views

ELF x86 - Why is return address pushed twice?

I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there. main: lea ecx, [esp+0x4 {argc}] and esp, 0xfffffff0 ...
jukebox's user avatar
  • 193
2 votes
1 answer
1k views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
John P's user avatar
  • 207