Hot answers tagged

12 votes

Is there any tool to visually see program stack in linux while debugging?

You can easily view it using Visual Panels in radare2. Here's a teaser: Installation First of all, install radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $...
user avatar
  • 8,579
9 votes
Accepted

How to print the value of register with Radare 2

Printing the registry values in radare2 is quite simple. All registers You can print all the General Purpose registers using dr: [0x55bea3305070]> dr rax = 0x55bea3305070 rbx = 0x00000000 rcx = ...
user avatar
  • 8,579
8 votes
Accepted

ELF x86 - Why is return address pushed twice?

It was present on the stack before and esp, 0xfffffff0 instruction that aligns the stack to 16 bytes. This instruction doesn't erase the data that was previously at esp (so ecx-4 still points to the ...
user avatar
  • 3,179
7 votes
Accepted

What could be the purpose of XORing esp with a global variable? (stack canary protection)

Yes, this is an implementation of what's often called "Stack Canaries", a method of stack Buffer Overflow Protection. That example you're describing is specifically the method used by Visual Studio, ...
user avatar
  • 11.3k
7 votes

Why doesn't this retn instruction return from the function?

The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of ...
user avatar
6 votes
Accepted

Computing subtracted stack space for a function manually

Older compilers made space for function parameters on the stack by pushing them, and popping from the stack after the function call; newer compilers optimize this. For example, while a function gets ...
user avatar
6 votes
Accepted

Understanding Program Arguments on the Stack in Assembly

First of all, you have to understand that there is a specification for all these things. These specifications differ from one assembly language to another and from one operating system to the other. ...
user avatar
  • 18k
5 votes

What could be the purpose of XORing esp with a global variable? (stack canary protection)

Yes, this is Microsoft's stack overflow protection, commonly known as "GS cookie". From Compiler Security Checks In Depth: When the function is compiled with /GS, the functions prolog will set ...
user avatar
  • 34.6k
5 votes
Accepted

How to find the stack and other info in a memory dump? ARM

The only idea I have is to compare the dumps. The places that are same in all dumps are code or read only data. The places that are changing from dump to dump are either stack or section like .bss. ...
user avatar
  • 7,700
5 votes
Accepted

How to make stack variables into an array in IDA Pro

Double click the variable name in the disassembly, or press ctrl-k, to open the stack frame window. You can change your variable types there.
user avatar
5 votes

Segmentation on x86 for stack canaries

Check the stack protection in the linux kernel source. The gs register gets initialized by the kernel to a percpu structure, which contains a random value that's intended to be used as stack canary. ...
user avatar
5 votes
Accepted

Writing an exploit for sample-application

Why is it not working. This example is basically from an older book I'm reading. But theoretically it should work so I think.... It's because you're overwriting the return address on the stack ...
user avatar
5 votes
Accepted

Remote Debugging Linux Binaries - Stack Address Changes?

On modern Linux machines ASLR is enabled by default. As a result, when the process image for the binary is created in virtual memory, the base address of the stack is located at a random offset: /* *...
user avatar
  • 6,819
4 votes

Can mprotect set the stack itself as executable?

Yes, mprotect can be used to make the stack executable. See, for example: https://github.com/gcc-mirror/gcc/blob/master/libgcc/enable-execute-stack-mprotect.c http://rethinkdb.com/blog/handling-...
user avatar
4 votes
Accepted

Return address on ESP?

Lets take this small example code: #include <stdio.h> #include <stdlib.h> int foo (int a) { return a ? a << 2: 1000; } int main() { printf("The result of foo(10) is %d\n", foo(...
user avatar
  • 18k
4 votes
Accepted

Extracting threads' stack from Windows memory dump

I am Not Sure what you are looking for let me try i have a dump file of a vm too MEMORY.dmp from a vm that ran xp sp3 created using .crash from a kernel debugger attached to it i loaded it ...
user avatar
  • 14.8k
4 votes

Is there any tool to visually see program stack in linux while debugging?

You can use gdb, for example let see this simple program #include <stdio.h> int main(){ printf("hello world\n"); return 0; } Compile it gcc -o simple simple.c -g Run with gdb gdb ./...
user avatar
4 votes

Is there any tool to visually see program stack in linux while debugging?

please have a look to gef it is incredibly useful and continuously improved. Here some notes from the main github page: Entirely OS Agnostic, NO dependencies: GEF is battery-included and is ...
user avatar
  • 141
4 votes
Accepted

How to execute a specific shellcode with a non executable stack without using format string? (without ASLR and stack cookie)

First thing that comes to mind when you have non-executable stack is Return-oriented programming which, as the name implies, uses return to execute a code you want. When using ROP, you will want to ...
user avatar
  • 693
4 votes

Remote Debugging Linux Binaries - Stack Address Changes?

Most modern operating systems never guaranteed the stack's location will be the same for different process creations to begin with, and this was mostly a byproduct of deterministic execution of those ...
user avatar
  • 11.3k
3 votes

Understanding the output of Windbg's `dds esp`

The stack can be used to hold all kinds of values, including ones that look like return addresses but aren't. If stack-frames are omitted, then it becomes very difficult to trace backwards without ...
user avatar
  • 4,511
3 votes
Accepted

Two arguments pushed on stack, callee only shows one argument

Yes, the disassembler is not including it since [ebp+8] is not referenced anywhere in the procedure.
user avatar
  • 1,321
3 votes
Accepted

Is stack migration a standard attack technique?

I don't know Chinese but It seems the post describes stack pivoting. It is a technique used in cases where you can't control the contents of the actual stack used by the target but can change the ...
user avatar
  • 34.6k
3 votes

Return address on ESP?

The comment of Guntram Blohm explains your situation. Since you put the breakpoint at call, the instruction is not executed yet, and you do not see the returned address is pushed in the stack yet. But ...
user avatar
3 votes

Can we see local variable directly by inspecting the disk image (file in disk)?

First, local variables needn't be stored on the stack. Modern compilers will first try to use CPU registers to store local variables. Next, heap and stack are terms that relate to virtual memory. ...
user avatar
3 votes
Accepted

IDA makes an incorrect guess about how a virtual function affects the stack. How can I correct/override it?

You can use Alt-K shortcut to fix the stack pointer. Its documentation is here.
user avatar
  • 7,700
3 votes

Why doesn't this retn instruction return from the function?

My answers: Why is that? The program you are looking at is probably using some software obfuscation because this is not a usual way to return from a function. My guess is that this function is just ...
user avatar
  • 18k
3 votes
Accepted

Is the value of EBP before the main function important?

__libc_start_main is called by the entry point code (usually in a file called crt0.S or similar) and that code usually sets up the initial EBP value (usually to 0, to denote end of the call stack for ...
user avatar
  • 34.6k
3 votes
Accepted

How to examine/edit stack memory contents using radare2 in debug mode?

To examine in radare2 you can think as 'print values' and you can use: px show hexdump pxl display N lines (rows) of hexdump pxr[j] show words with ...
user avatar
  • 476
3 votes

ASLR in Linux Vs Windows

By using this tool from Didier Stevens you've been able to check/set/unset DEP/ASLR characteristics of your file. Check the file like this: setdllcharacteristics.exe yourfile.exe If the output said ...
user avatar
  • 71

Only top scored, non community-wiki answers of a minimum length are eligible