Questions tagged [stack]

Part of a process memory that stores all the automatic variables and the call-stack of the functions currently called by the process.

Filter by
Sorted by
Tagged with
8
votes
3answers
4k views

Is there any tool to visually see program stack in linux while debugging?

By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
6
votes
1answer
1k views

Segmentation on x86 for stack canaries

I just compiled some C code that reads in input using gets and disassembled the code. The platform is Ubuntu 32-bit. There are these 3 lines that check if the canary value has been tampered with. ...
5
votes
1answer
2k views

Writing an exploit for sample-application

I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application: #include <stdio.h> #include &...
4
votes
2answers
1k views

What could be the purpose of XORing esp with a global variable? (stack canary protection)

I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
4
votes
1answer
989 views

How to find the stack and other info in a memory dump? ARM

I'm reversing a closed platform to try gain execution using an exploit, a stack overflow. I've been told that (since there are no debuggers) the best way is to use RAM dumps (that I have) to try ...
4
votes
1answer
5k views

How to make stack variables into an array in IDA Pro

I've got a procedure in IDA Pro with a few local stack variables, but part of them belong to an array. I would like to define the array, but pressing * (Create Array) fails, and pressing Y (Set Type) ...
4
votes
2answers
347 views

Backtracing where a register gets initialized

I am currently trying to bypass a CRC check, that exists inline on many places in an application to check if memory pages in the .text section have been modified. Short explanation of the crc32 ...
3
votes
2answers
262 views

Why doesn't this retn instruction return from the function?

I disassembled an exe file on Windows with IDA and saw this function prologue: I see that when the retn executes instead of returning it jumps to sub_1314cba4. Why doesn't the retn instruction ...
3
votes
2answers
210 views

Remote Debugging Linux Binaries - Stack Address Changes?

Do stack addresses change every time we remotely debug a Linux binary using linux_server and IDA Pro? I am using IDA Pro and remote debug a linux binary which is running on a Linux machine and I am ...
3
votes
1answer
259 views

ELF x86 - Why is return address pushed twice?

I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there. main: lea ecx, [esp+0x4 {argc}] and esp, 0xfffffff0 ...
3
votes
1answer
3k views

Understanding Program Arguments on the Stack in Assembly

To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding ...
3
votes
1answer
562 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
3
votes
2answers
723 views

How to execute a specific shellcode with a non executable stack without using format string? (without ASLR and stack cookie)

First off we don't have ASLR and stack cookie, and assume we can't create our own files on this system So I'm trying to execute a shellcode in this code, this is what i have done so far: i have ...
3
votes
2answers
2k views

Extracting threads' stack from Windows memory dump

I have a memory dump of a VM running Windows server 2012 R2. The dump is of the entire RAM (4 GB). I want to extract as many features as possible from this dump. Mainly I want to extract all stacks ...
3
votes
1answer
147 views

Why EIP is being overwritten before local buffer ends?

I am doing a simple buffer overflow exercise, here is the source: //vuln.c #include <stdio.h> #include <string.h> int main(int argc, char* argv[]) { char buf[256]; strcpy(buf,...
3
votes
1answer
177 views

Basic hello world stack manipulation troubles

I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers". Here is the hello world program from the book (taken from chapter 3, page 12) : Now ...
3
votes
1answer
66 views

reason of padding in exploit

I was doing vulnserver bufferflow exploit. I saw a tutorial where the he makes a payload to exploit the server. Take a look at the exploit: #!/usr/bin/python import socket target_ip = "10.0.2....
3
votes
1answer
192 views

how to calculate max possible stack size utilization

Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython? currently my best approach is iterating through all functions and counting stack-...
3
votes
0answers
72 views

more memory allocated on the stack than seems to be needed [duplicate]

Im working on the bof challange in http://pwnable.kr/play.php. the source code has a function func: void func(int key){ char overflowme[32]; printf("overflow me : "); gets(overflowme); // ...
2
votes
2answers
86 views

Can we see local variable directly by inspecting the disk image (file in disk)?

As far as I know, global and static variables are stored in heap memory, while local variables are on stack memory. I think this is the case when we speak about a binary file (like PE) that is located ...
2
votes
1answer
305 views

How to examine/edit stack memory contents using radare2 in debug mode?

How can i examine/edit stack contents using radare2, just like gdb ? Is there a way to examine memory using $rbp or $rsp register like below. x $rbp-10 <--- something like this which can dump from ...
2
votes
1answer
266 views

IDA makes an incorrect guess about how a virtual function affects the stack. How can I correct/override it?

So this may be a weird question. I'm working with a windows 32-bit executable in IDA that was originally programmed in C/C++ (Mostly likely with Visual Studio .NET 2002). For the virtual function ...
2
votes
2answers
172 views

Two arguments pushed on stack, callee only shows one argument

I have found myself confused while reversing some programs (specifically the IOLI Crackme challenges). I have no trouble solving them, but I have come across something that I do not understand and it ...
2
votes
1answer
814 views

Why stack canary can be brute-force one byte at a time?

I am reading brute-forcing stack canary. But I am confused why the server can be brute-forced one byte at a time on a crashable-server and what does mean this fork-and-accept ?
2
votes
1answer
116 views

ARM system crashes after changing stack address

-- Edit with latest update on the problem, it is not solved yet :( -- While playing with an ARM embedded Linux system (Version 3.8.13), out of curiosity, I created a small "debug" kernel module. ...
2
votes
1answer
356 views

Stack variable information removed in IDA pro (free version)?

I'm using the IDApro free version and I was wondering why sometimes there could be a instruction like... mov [esp + 1140h + var_1234], ebx and if you click inside the bracket, and hit the letter K (...
2
votes
1answer
51 views

Where do mouse/keyboard GUI inputs get queued or stored?

Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing? I'm wondering if it'd be possible ...
2
votes
0answers
380 views

Fixing '__asm' in pseudocode in IDA PRO (inconsistent fpu stack error)

So I was doing some REing in IDA, changed a function parameter type and suddenly my stack pointer messes up (1025B361: inconsistent fpu stack). Does anyone know what to look for here or how to fix it? ...
1
vote
2answers
10k views

Return address on ESP?

I've read that the return address of a function call is always pushed on the ESP stack. But the thing when i tried to see that using gdb, I didn't find it. Here's the program written in C I've used : ...
1
vote
1answer
3k views

Can mprotect set the stack itself as executable?

I'm taking my first steps in memory exploitation in Linux. I'm following a tutorial for a practice VM($ uname -r -> 3.13.0-32-generic) The tutorial makes a call to mprotect to set a certain region ...
1
vote
1answer
611 views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
1
vote
1answer
34 views

Why does this x64 stack have other bytes and seems to be in reverse order?

I wrote the following small C program and you can also see the stack in the screenshot. My question is twofold: How come there are entire rows of other data between the 3 stack strings? Why is my ...
1
vote
1answer
148 views

radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char

Well, I've been digging around process command line arguments as well as environment variables a bit these last days, especially looking up the way main function arguments were pushed onto the stack. ...
1
vote
2answers
328 views

How to identify if buffer allocate on stack or heap?

When I looking on Ida with static analyze I see that buffer pass to function/ function fill data in buffer. How can I know if this buffer allocate in stack/ heap?
1
vote
1answer
156 views

How is data transferred from the process’ memory to the console screen?

I am learning about how the call stack works by reverse engineering binaries using Radare2 (in a Linux environment). The ISA on the server (a P5 micro-architecture) I am analyzing binaries off of is ...
1
vote
1answer
4k views

Passing argument through registers instead of the stack

I'm learning (and re-learning) C and assembly, and I came across a difference between what I've been taught and the actual result I have. Some code: int test(int a, int b){ return a + b; } int ...
1
vote
1answer
87 views

Function is returning to somewhere in stack

I'm trying to hook this 'recv callback' function and can manage to hook the function. However, when the 'new function' is supposed to return to its caller, it's instead returning to somewhere in stack,...
1
vote
1answer
152 views

How do I found out what register used for stack pointer on RISC architectures?

On some RISC architectures there's no notion of stack pointer register - there's some register, used to hold a stack pointer and address of the stack frame, but nowhere told explicitly what. So, how ...
1
vote
2answers
51 views

What is the state of the stack in the entry function?

I have an ELF binary and in the entry function the first two instructions are: XOR EBP, EBP POP ESI I'm curious what the state of the stack is at the start of the entry function in ELF and PE ...
1
vote
1answer
49 views

Find out if address store in heap or stack

While dynamic debugging with ida and gdb-server on binary file running on linux , I saw address that store some value. How can I know if this address allocated in stack or in heap?
1
vote
1answer
648 views

ESP out of range of “Stack View” in IDA

A very similar (or exact) question was asked here, though it was not answered properly. I am debugging a process in IDA and am unable to view the dynamic contents of the stack because its value ...
1
vote
1answer
859 views

Moving xmm0 onto the stack results in a access violation exception

Reversing an application that crashes at the last line of the following instructions: sub rsp,68 mov qword ptr ss:[rsp+B0],rcx mov qword ptr ss:[rsp+B8],rdx mov qword ptr ss:[rsp+C0],r8 mov qword ptr ...
1
vote
2answers
103 views

ELF File format Two terminating null dword towards 0xc0000000?

While I was reversing an elf binary, I tried to manually compute my environment variable's address. Therefore I found this documentation and we're said that there is one NULL DWORD at the end of the ...
1
vote
0answers
944 views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
1
vote
0answers
611 views

How can I control local variable ordering on stack in gcc?

I am writing a reversing challenge where I need to seed a bug. It's important to have a particular ordering of local variable on stack in a method. However, gcc seems to shuffle those around. How can ...
1
vote
1answer
136 views

Ghidra Decompiler Optimized Strings

Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so: If I try to set the type of puStack40 to char[38], I get the following ...
0
votes
2answers
834 views

Understanding the output of Windbg's `dds esp`

I am not sure if I am understanding the raw output of dds esp or its 64-bit counterpart dqs rsp properly. When I see a list of entries in the stack, I tend to assume that wherever I see return ...
0
votes
2answers
69 views

ASM Debuggers that visualize the stack (beginner friendly)

(Cross-posted from Stack Overflow) Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image: I use gdb for most ...
0
votes
1answer
138 views

Is stack migration a standard attack technique?

I am reading up a writeup on an example attack here where I have come across the technique called stack migration. The page is translated to English. Googling doesn't give me any fruitful pointer on ...
0
votes
1answer
27 views

How to calculate value inside stack segment (SS)

I have an assembly row which the following information: EBP = 006FFB50 SS = 002B When I looked on this row: mov eax,dword ptr ss:[ebp+8] I assumed that EBP + 8 = 006FFB50 + 8 = 006FFB58. But ...