Hot answers tagged

7

Yes, this is an implementation of what's often called "Stack Canaries", a method of stack Buffer Overflow Protection. That example you're describing is specifically the method used by Visual Studio, enabled by default since Visual Studio 2005, implemented since Visual Studio 2003. It is also called GS protection due to the fact Visual Studio provided the ...


7

You can easily view it using Visual Panels in radare2. Here's a teaser: Installation First of all, install radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $ ./sys/install.sh Debugging To debug a program with radare2 call it with the debug flag -d: $ r2 -d /bin/ls Now the program is opened in debug mode. ...


7

It was present on the stack before and esp, 0xfffffff0 instruction that aligns the stack to 16 bytes. This instruction doesn't erase the data that was previously at esp (so ecx-4 still points to the return address), but stack pointer points now to possibly different value than at the begining of the function. So there is a need to push the return value ([ecx-...


6

Older compilers made space for function parameters on the stack by pushing them, and popping from the stack after the function call; newer compilers optimize this. For example, while a function gets executed, the stack changed like this: start calling after before scanf after scanf printf printf ...


6

First of all, you have to understand that there is a specification for all these things. These specifications differ from one assembly language to another and from one operating system to the other. These global specification are called Application Binary Interface (ABI) and define, among other things, what we call the 'calling conventions' of functions. ...


6

The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of the stack and redirect the execution there. Well, it depends on what you mean by damaging the stack. The stack is just a place in memory and the damage can only ...


5

Yes, this is Microsoft's stack overflow protection, commonly known as "GS cookie". From Compiler Security Checks In Depth: When the function is compiled with /GS, the functions prolog will set aside an additional four bytes and add three more instructions as follows: sub esp,24h mov eax,dword ptr [___security_cookie (408040h)] xor eax,dword ptr ...


5

The only idea I have is to compare the dumps. The places that are same in all dumps are code or read only data. The places that are changing from dump to dump are either stack or section like .bss. After finding places that are not changing I'd try to disassemble these places in order to divide between code and data. I think that the places with the code ...


5

Why is it not working. This example is basically from an older book I'm reading. But theoretically it should work so I think.... It's because you're overwriting the return address on the stack with 0xffffd2ec instead of 0x0804852f (the latter is the address for secret()). If you thus use '{print "A"x24; print "\x2f\85\04\08"; }' instead, it should work. ...


5

Check the stack protection in the linux kernel source. The gs register gets initialized by the kernel to a percpu structure, which contains a random value that's intended to be used as stack canary. This stack canary is at offset 20 (0x14) for 32 bit programs. It's randomized for each process to avoid malware being able to rely on it being always the same ...


5

On modern Linux machines ASLR is enabled by default. As a result, when the process image for the binary is created in virtual memory, the base address of the stack is located at a random offset: /* * These are the functions used to load ELF style executables and shared * libraries. There is no binary dependent code anywhere else. */ #ifndef ...


4

Double click the variable name in the disassembly, or press ctrl-k, to open the stack frame window. You can change your variable types there.


4

Yes, mprotect can be used to make the stack executable. See, for example: https://github.com/gcc-mirror/gcc/blob/master/libgcc/enable-execute-stack-mprotect.c http://rethinkdb.com/blog/handling-stack-overflow-on-custom-stacks/ You can troubleshoot further by examining the value of errno after the mprotect call.


4

Lets take this small example code: #include <stdio.h> #include <stdlib.h> int foo (int a) { return a ? a << 2: 1000; } int main() { printf("The result of foo(10) is %d\n", foo(10)); return EXIT_SUCCESS; } Once in assembly we get: 0000000000400506 <foo>: 400506: 55 push %rbp 400507: 48 ...


4

I am Not Sure what you are looking for let me try i have a dump file of a vm too MEMORY.dmp from a vm that ran xp sp3 created using .crash from a kernel debugger attached to it i loaded it using windbg as below windbg -z memory.dmp now i thought i will count how many threads are running so i did some thing like this kd> r $t0 = 0; !...


4

First thing that comes to mind when you have non-executable stack is Return-oriented programming which, as the name implies, uses return to execute a code you want. When using ROP, you will want to use the program's executable and dlls (or .so files for linux) and rely as little as you can on system dlls as they change with the OS version. The idea is that ...


4

Most modern operating systems never guaranteed the stack's location will be the same for different process creations to begin with, and this was mostly a byproduct of deterministic execution of those allocations during the operating system's process creation flow. Moreover, that fact was then used quite frequently to use constant values for stack addresses ...


3

The stack can be used to hold all kinds of values, including ones that look like return addresses but aren't. If stack-frames are omitted, then it becomes very difficult to trace backwards without disassembling the function to see how it stores preserved values such as registers.


3

First, local variables needn't be stored on the stack. Modern compilers will first try to use CPU registers to store local variables. Next, heap and stack are terms that relate to virtual memory. Virtual memory starts to exist when the operating system creates the process. It does not exist when the file is on disk only. Therefore, you can never see a ...


3

I don't know Chinese but It seems the post describes stack pivoting. It is a technique used in cases where you can't control the contents of the actual stack used by the target but can change the stack pointer to point into some other memory area you control (e.g. heap). For example, this blog post explains: With stack pivoting, attacks can pivot from the ...


3

please have a look to gef it is incredibly useful and continuously improved. Here some notes from the main github page: Entirely OS Agnostic, NO dependencies: GEF is battery-included and is installable in 2 seconds (unlike PwnDBG). Fast limiting the number of dependencies and optimizing code to make the commands as fast as possible (unlike PwnDBG). Provides ...


3

Yes, the disassembler is not including it since [ebp+8] is not referenced anywhere in the procedure.


3

The comment of Guntram Blohm explains your situation. Since you put the breakpoint at call, the instruction is not executed yet, and you do not see the returned address is pushed in the stack yet. But if you let it execute (for example by typing si), then you will see the returned address is pushed into the stack.


3

You can use Alt-K shortcut to fix the stack pointer. Its documentation is here.


3

My answers: Why is that? The program you are looking at is probably using some software obfuscation because this is not a usual way to return from a function. My guess is that this function is just here to break automatic binary analysis. Now, what does happen precisely here... In fact, this is quite simple, the address of sub_1313cba4 is pushed on to the ...


3

__libc_start_main is called by the entry point code (usually in a file called crt0.S or similar) and that code usually sets up the initial EBP value (usually to 0, to denote end of the call stack for the debuggers). Here's a sample entry point code from a random ELF binary: _start: xor ebp, ebp pop esi mov ecx, esp and ...


3

To examine in radare2 you can think as 'print values' and you can use: px show hexdump pxl display N lines (rows) of hexdump pxr[j] show words with references to flags and code (q=quiet) Example: > px [nBytes] @[address][offset] "Print hex 10 bytes at rbp plus 10" [0x5618eccbf77a]> px 10 @rbp+10 > ...


2

In most cases, even if there's no register that has any hardware/instruction support for being a stack pointer, either the processor manufacturer or the operating system designer defines an ABI (application binary interface) which, among others, contains a convention for calling subroutines. Compiler vendors normally conform to this ABI to make their code ...


2

alt + k -> right click -> copy to clipboard whole table -> paste to notepad -> save


2

This is most likely an optimized tail call. The original code probably looked similar to this: int f1() { //some code which was optimized out return f2();// &f2=0x10002135a } Since there is no code after calling f2, there is no need to perform any additional actions, so the compiler restored the original stack pointer and jumped to f2 instead of ...


Only top voted, non community-wiki answers of a minimum length are eligible