Skip to main content
9 votes
Accepted

Heap Chunk Structure Does Not Contain Previous Section Info

The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free. This image is more appropriate of what an allocated heap ...
0xec's user avatar
  • 6,090
9 votes
Accepted

Shellcode challenge - shellcode works in test program, segfaults in actual binary

It looks like you have two issues. 1) You are overwriting your input buffer with those push-es so that why you have some junk on the stack and that's why our application crashes. See those two ...
Paweł Łukasik's user avatar
6 votes
Accepted

ASM working as is, but not in a C program

The problem with you shellcode and the why it differs if you run from C program or not is the initial values. The registers that are used when executing execv (second page) are: eax = 0x0b ebx = ptr ...
Paweł Łukasik's user avatar
5 votes
Accepted

alphanumeric shellcode

Alphanumeric shellcode expects the location of the shellcode to be stored in a register, since the usual technique of call/pop can't be performed with the limited character set. In your example above ...
s3c's user avatar
  • 258
5 votes
Accepted

x86-64 CALL opcode + disassembly

relative address can be forward or backward from end of current instruction or start of next instruction that e8 00 00 00 00 will be call to the next immediate instruction forward can be e8 ( ...
blabb's user avatar
  • 16.4k
5 votes
Accepted

Shellcode not working correctly

You're showing x86 (32bit) shellcode, but are not compiling your program for that architecture, so gcc most likely creates an amd64 (64bit) executable instead. This can be fixed by adding the -m32 ...
wasamasa's user avatar
  • 166
4 votes

A buffer overflow exercise using a shellcode

Okay, so I will try to answer to all your questions and add a few remarks. Do not disable ASLR system-wide, prefer to disable it within the current process. In fact, echoing 0 in randomize_va_space ...
perror's user avatar
  • 19.1k
4 votes
Accepted

WinDBG Hung on Shellcode Execution

can you clarify if the error you are getting is related to message that says this may be caused by another thread holding the LoaderLock ? if that is the case then it means you allocate memory etc ...
blabb's user avatar
  • 16.4k
4 votes

How to load shellcode into Ghidra

Compile and load: #include <stdio.h> char shellcode[] = "\x48\x83\xEC\x28\x48\x83\xE4\xF0\x48\x8D\x15\x66\x00\x00\x00" "\x48\x8D\x0D\x52\x00\x00\x00\xE8\x9E\x00\...
dcom-launch's user avatar
4 votes
Accepted

How to load shellcode into Ghidra

you have a string you cant load a string as is into a disassembler you may need to un-escape them into binary for example "\x48" is "H" if you have a compiler compile and call it ...
blabb's user avatar
  • 16.4k
3 votes
Accepted

how to find memory objects using immunity debugger

Put a INT3 (F2) breakpoint on the recv function (To jump to that function, hit CTRL+G then type recv to the textbox which just appeared, and then hit enter) within Immunity Debugger, and observe the ...
Dominik Antal's user avatar
3 votes

Meaning of code used to find kernel32.dll in shellcode

In WinDbg: 0:000> dt ntdll!_TEB -y ProcessEnvironmentBlock->Ldr->InM +0x030 ProcessEnvironmentBlock : +0x00c Ldr : +0x014 ...
blabb's user avatar
  • 16.4k
3 votes
Accepted

Working Linux assembly XOR Encoder/Decoder Failing on Windows

There are few issues with your code. 1st is what Igor mentioned - .text section is RO. This was solved in this answer. The 2nd is that you did not copy correctly the bytes or lost some of them in ...
Paweł Łukasik's user avatar
3 votes
Accepted

Basic shellcode doesn't work when read from stdin

With the shellcode given I was not able to get a shell. If you strace the binary when getting input from the stack execve("/bin//sh", ["/bin//sh"], [/* 0 vars */]) = -1 EFAULT (Bad address) char *...
sudhackar's user avatar
  • 2,709
3 votes
Accepted

Buffer overflow on server

We have two major stack protection for buffer overflows: Stack canaries Non-executable stack You land on nopsled but, you get segmentation fault. Because your operating system marked program stack ...
Kerim Can Kalıpcıoğlu's user avatar
3 votes

ASM working as is, but not in a C program

Okay, so according to gdb the shellcode does run, so it's probably placed into .text. You should try to step through the shellcode (e.g. using stepi) to see on what instruction it faults.
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

x86 shellcode leads to segmentation fault

Wrong Parameters I was able to solve my problem! The function execve has the following definition: int execve(const char *filename, char *const argv[], char *const envp[]);` ^ ...
winklerrr's user avatar
  • 161
3 votes

ShellCode not running as expected - showing segmentation fault core dump

The argument -z execstack only allows stack to execute code, but the code is a global variable, which is not on stack, so you can do some simple changes to make your code work. For example, #include &...
zeze's user avatar
  • 31
3 votes

x64 buffer overflow - tcp shell payload

process 6540 is executing new program: /bin/dash Error in re-setting breakpoint 1: No symbol table is loaded. Use the "file" command. That's not an error you need to worry about, it likely ...
multithr3at3d's user avatar
2 votes
Accepted

Reverse a BFLT file

bFLT format is used in uCLinux systems and its executables use one of two approaches to make system calls: Statically linked libc (uClibc). In this case you should see explicit syscalls (SVC ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes
Accepted

How to Make .text Section in Assembly Writeable for Win7-64 EXE

I don't see that option in golink linker but if you use i.e. link.exe (Microsoft (R) Incremental Linker Version 14.11.25506.0) then you can use /SECTION parameter to specify that. link /SUBSYSTEM:...
Paweł Łukasik's user avatar
2 votes

Working Linux assembly XOR Encoder/Decoder Failing on Windows

I think the problem is that the executable code is not writeable by default on Windows, so it fails when xor tries to modify the code. You should look into how to modify .text section permissions, ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes
Accepted

Debugging EXE File in Windbg and How to set Breakpoints in Assembly

It seems bp $exentry should set breakpoint on the entrypoint, then you can continue (g) until you hit it.
Igor Skochinsky's user avatar
  • 36.8k
2 votes
Accepted

How to find a fuction hash when manually resolving in shellcode?

iirc you cant go from a constant hash to name but hash an exported name compare the generated hash with the constant you can see a discussion and an implementation here a ripped python ...
blabb's user avatar
  • 16.4k
2 votes
Accepted

segmentation fault at `mov byte [esi+7], al`

The instruction that causes the SIGSEGV is trying to store a '\0' after the 'h' in "/bin/shJAAAABBBB". All your code/data is in the .text section which is probably read-only. Run objdump -h on the ...
booto's user avatar
  • 931
2 votes
Accepted

Why can I inherit handles from WSASocketA and not from socket?

Windows socket() creates a socket with WSA_FLAG_OVERLAPPED flag set and inheritable by default. Windows WSASocket() allows you to specify WSA_FLAG_OVERLAPPED and WSA_FLAG_NO_HANDLE_INHERIT. If you ...
gstrauss's user avatar
  • 136
2 votes
Accepted

How can I get my shellcode to work outside of GDB?

I don't think your shell code works even in gdb. The problem is in the address of the string in your shellcode. You are not showing in your question how did you get the address of the string that you ...
Paweł Łukasik's user avatar
2 votes
Accepted

How to extract port number from shellcode

The connect syscall takes a sockaddr structure as an argument, which looks something like this: struct sockaddr_in { short sin_family; u_short sin_port; struct in_addr ...
Shane Reilly's user avatar
2 votes
Accepted

Statically Reverse Engineering Shellcode - IDA to Ghidra

Starting from address 0x56 all your instructions seems to be off. And if you look closely it there is a pattern how much off they are from the original. For example, at offset 0x58, there's supposed ...
Paweł Łukasik's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible