Questions tagged [stack]

Part of a process memory that stores all the automatic variables and the call-stack of the functions currently called by the process.

Filter by
Sorted by
Tagged with
2
votes
1answer
334 views

Stack variable information removed in IDA pro (free version)?

I'm using the IDApro free version and I was wondering why sometimes there could be a instruction like... mov [esp + 1140h + var_1234], ebx and if you click inside the bracket, and hit the letter K (...
1
vote
1answer
793 views

Moving xmm0 onto the stack results in a access violation exception

Reversing an application that crashes at the last line of the following instructions: sub rsp,68 mov qword ptr ss:[rsp+B0],rcx mov qword ptr ss:[rsp+B8],rdx mov qword ptr ss:[rsp+C0],r8 mov qword ptr ...
1
vote
1answer
87 views

Function is returning to somewhere in stack

I'm trying to hook this 'recv callback' function and can manage to hook the function. However, when the 'new function' is supposed to return to its caller, it's instead returning to somewhere in stack,...
3
votes
2answers
2k views

Extracting threads' stack from Windows memory dump

I have a memory dump of a VM running Windows server 2012 R2. The dump is of the entire RAM (4 GB). I want to extract as many features as possible from this dump. Mainly I want to extract all stacks ...
-1
votes
1answer
722 views

Stack smashing in X86_64 leads to Segmentation fault .

I been trying to smash the stack in an x86_64 machine , the payload gets executed when I use a debugger (gdb) and fails with Segmentation fault when I run it normally Here is the vulnerable program ...
0
votes
1answer
202 views

Are arguments of the called function part of its stack frame in Intel x86?

Hi everyone and sorry for the silly question. Let's say that "main" calls an "add" function (pseudocode): main { add(5,10) } The stack would be something similar: ...main... | 10 | | 05 | | ...
5
votes
1answer
2k views

Writing an exploit for sample-application

I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application: #include <stdio.h> #include &...
1
vote
1answer
3k views

Can mprotect set the stack itself as executable?

I'm taking my first steps in memory exploitation in Linux. I'm following a tutorial for a practice VM($ uname -r -> 3.13.0-32-generic) The tutorial makes a call to mprotect to set a certain region ...
1
vote
2answers
10k views

Return address on ESP?

I've read that the return address of a function call is always pushed on the ESP stack. But the thing when i tried to see that using gdb, I didn't find it. Here's the program written in C I've used : ...
1
vote
1answer
150 views

How do I found out what register used for stack pointer on RISC architectures?

On some RISC architectures there's no notion of stack pointer register - there's some register, used to hold a stack pointer and address of the stack frame, but nowhere told explicitly what. So, how ...
3
votes
1answer
548 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
4
votes
1answer
5k views

How to make stack variables into an array in IDA Pro

I've got a procedure in IDA Pro with a few local stack variables, but part of them belong to an array. I would like to define the array, but pressing * (Create Array) fails, and pressing Y (Set Type) ...
1
vote
2answers
103 views

ELF File format Two terminating null dword towards 0xc0000000?

While I was reversing an elf binary, I tried to manually compute my environment variable's address. Therefore I found this documentation and we're said that there is one NULL DWORD at the end of the ...
6
votes
1answer
1k views

Segmentation on x86 for stack canaries

I just compiled some C code that reads in input using gets and disassembled the code. The platform is Ubuntu 32-bit. There are these 3 lines that check if the canary value has been tampered with. ...
0
votes
1answer
811 views

Dump the stack in Ollydbg

Is there a way to dump the stack of a program while debugging in ollydbg and store the result in a file ?
0
votes
1answer
1k views

Right order of function arguments

i have the following function with three arguments: sub_602667B proc near arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push [esp+arg_8] push [esp+4+arg_4] push 15 ...

1
2