Did you notice that you indeed changed the desired variable?
You have changed the modified variable
Anyway, regarding the 2nd question, this is an intended behavior after the following pull-request was merged to radare2.
Now it is requires that you'll have 0x
prefixed to the passed value, so you can do something like this:
wopO `dr ebp`
or something like that:
wopO `?v ebp`
The backticks are used to execute radare2 command so you basically use the result of the inner command and pass it to wopO
Regarding the first question, after some amount of chars (i.e long input) you'll get a Segfault, that's mean that your input cause a corruption and you indeed made a "damage" to eip. If you want to see how eip
:
To disable it temporarily, execute:
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
And to enable it again, execute:
echo 2 | sudo tee /proc/sys/kernel/randomize_va_space
If you want to change the value permanently, say if it is an exploitation-dedicated machine, add the following setting to /etc/sysctl.conf
, for example:
echo "kernel.randomize_va_space = 0" >> /etc/sysctl.conf
and run the sysctl -p
command.