Skip to main content
12 votes

Is there any tool to visually see program stack in linux while debugging?

You can easily view it using Visual Panels in radare2. Here's a teaser: Installation First of all, install radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $...
Megabeets's user avatar
  • 8,999
11 votes
Accepted

How to print the value of register with Radare 2

Printing the registry values in radare2 is quite simple. All registers You can print all the General Purpose registers using dr: [0x55bea3305070]> dr rax = 0x55bea3305070 rbx = 0x00000000 rcx = ...
Megabeets's user avatar
  • 8,999
8 votes
Accepted

ELF x86 - Why is return address pushed twice?

It was present on the stack before and esp, 0xfffffff0 instruction that aligns the stack to 16 bytes. This instruction doesn't erase the data that was previously at esp (so ecx-4 still points to the ...
bart1e's user avatar
  • 3,409
7 votes
Accepted

What could be the purpose of XORing esp with a global variable? (stack canary protection)

Yes, this is an implementation of what's often called "Stack Canaries", a method of stack Buffer Overflow Protection. That example you're describing is specifically the method used by Visual Studio, ...
NirIzr's user avatar
  • 11.8k
7 votes

Why doesn't this retn instruction return from the function?

The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of ...
Paweł Łukasik's user avatar
6 votes
Accepted

Understanding Program Arguments on the Stack in Assembly

First of all, you have to understand that there is a specification for all these things. These specifications differ from one assembly language to another and from one operating system to the other. ...
perror's user avatar
  • 19.1k
5 votes

What could be the purpose of XORing esp with a global variable? (stack canary protection)

Yes, this is Microsoft's stack overflow protection, commonly known as "GS cookie". From Compiler Security Checks In Depth: When the function is compiled with /GS, the functions prolog will set ...
Igor Skochinsky's user avatar
  • 36.8k
5 votes
Accepted

How to find the stack and other info in a memory dump? ARM

The only idea I have is to compare the dumps. The places that are same in all dumps are code or read only data. The places that are changing from dump to dump are either stack or section like .bss. ...
w s's user avatar
  • 8,508
5 votes
Accepted

Remote Debugging Linux Binaries - Stack Address Changes?

On modern Linux machines ASLR is enabled by default. As a result, when the process image for the binary is created in virtual memory, the base address of the stack is located at a random offset: /* *...
julian's user avatar
  • 7,158
4 votes

Is there any tool to visually see program stack in linux while debugging?

You can use gdb, for example let see this simple program #include <stdio.h> int main(){ printf("hello world\n"); return 0; } Compile it gcc -o simple simple.c -g Run with gdb gdb ./...
invictus85's user avatar
4 votes

Is there any tool to visually see program stack in linux while debugging?

please have a look to gef it is incredibly useful and continuously improved. Here some notes from the main github page: Entirely OS Agnostic, NO dependencies: GEF is battery-included and is ...
Alberto's user avatar
  • 141
4 votes
Accepted

Extracting threads' stack from Windows memory dump

I am Not Sure what you are looking for let me try i have a dump file of a vm too MEMORY.dmp from a vm that ran xp sp3 created using .crash from a kernel debugger attached to it i loaded it ...
blabb's user avatar
  • 16.4k
4 votes

Remote Debugging Linux Binaries - Stack Address Changes?

Most modern operating systems never guaranteed the stack's location will be the same for different process creations to begin with, and this was mostly a byproduct of deterministic execution of those ...
NirIzr's user avatar
  • 11.8k
4 votes
Accepted

Cutter shows addresses relative to stack but not rbp. How to change it?

The two pictures probably show the same binary being analyzed. But the two Cutter versions might not be the same, and that's likely the cause for the discrepancy you see. Cutter is a front end for ...
feldspar's user avatar
3 votes
Accepted

IDA makes an incorrect guess about how a virtual function affects the stack. How can I correct/override it?

You can use Alt-K shortcut to fix the stack pointer. Its documentation is here.
w s's user avatar
  • 8,508
3 votes

Why doesn't this retn instruction return from the function?

My answers: Why is that? The program you are looking at is probably using some software obfuscation because this is not a usual way to return from a function. My guess is that this function is just ...
perror's user avatar
  • 19.1k
3 votes
Accepted

Is stack migration a standard attack technique?

I don't know Chinese but It seems the post describes stack pivoting. It is a technique used in cases where you can't control the contents of the actual stack used by the target but can change the ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

Understanding the output of Windbg's `dds esp`

The stack can be used to hold all kinds of values, including ones that look like return addresses but aren't. If stack-frames are omitted, then it becomes very difficult to trace backwards without ...
peter ferrie's user avatar
  • 4,709
3 votes

Can we see local variable directly by inspecting the disk image (file in disk)?

First, local variables needn't be stored on the stack. Modern compilers will first try to use CPU registers to store local variables. Next, heap and stack are terms that relate to virtual memory. ...
Thomas Weller's user avatar
3 votes
Accepted

Moving xmm0 onto the stack results in a access violation exception

According to definition of the assembly command movdqathe memory operand should be aligned by 16 (see Intel SDM at Vol. 2B 4-63): When the source or destination operand is a memory operand, the ...
w s's user avatar
  • 8,508
3 votes
Accepted

Passing argument through registers instead of the stack

This behavior is totally normal. The way functions are handled is usually described in what's called an ABI (Application Binary Interface). It defines calling conventions which detail how a call is ...
yaspr's user avatar
  • 2,673
3 votes
Accepted

Two arguments pushed on stack, callee only shows one argument

Yes, the disassembler is not including it since [ebp+8] is not referenced anywhere in the procedure.
cimarron's user avatar
  • 1,341
3 votes
Accepted

Is the value of EBP before the main function important?

__libc_start_main is called by the entry point code (usually in a file called crt0.S or similar) and that code usually sets up the initial EBP value (usually to 0, to denote end of the call stack for ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

How to examine/edit stack memory contents using radare2 in debug mode?

To examine in radare2 you can think as 'print values' and you can use: px show hexdump pxl display N lines (rows) of hexdump pxr[j] show words with ...
Ricardo's user avatar
  • 501
3 votes

ASLR in Linux Vs Windows

By using this tool from Didier Stevens you've been able to check/set/unset DEP/ASLR characteristics of your file. Check the file like this: setdllcharacteristics.exe yourfile.exe If the output said ...
Sina's user avatar
  • 81
3 votes
Accepted

How to calculate value inside stack segment (SS)

Registers ss, cs, ds, es, gs, fs are special. They are called segment registers and contain not addresses but selectors. A selector is used by the CPU as a reference to a segment - area of memory with ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

Reverse-engineering a 90s CNC machine (FORTH like) firmware

interesting project you've got here and you're giving a good overview - maybe too much (in comparison to most of the other questions here) i think you need to search for (retired) poeple that got deep ...
llm's user avatar
  • 336
3 votes
Accepted

why some functions push data before the prologue

It's saving registers that might be modified by the function. Notice that you can see assignments to all three of those registers throughout the function body. Also notice at the bottom of your ...
Rolf Rolles's user avatar
  • 9,198
2 votes
Accepted

whats the purpose of this code snippet?

This is most likely an optimized tail call. The original code probably looked similar to this: int f1() { //some code which was optimized out return f2();// &f2=0x10002135a } Since there is no ...
Igor Skochinsky's user avatar
  • 36.8k

Only top scored, non community-wiki answers of a minimum length are eligible