12
votes
Is there any tool to visually see program stack in linux while debugging?
You can easily view it using Visual Panels in radare2. Here's a teaser:
Installation
First of all, install radare2 from git repository:
$ git clone https://github.com/radare/radare2.git
$ cd radare2
$...
- 9,019
11
votes
Accepted
How to print the value of register with Radare 2
Printing the registry values in radare2 is quite simple.
All registers
You can print all the General Purpose registers using dr:
[0x55bea3305070]> dr
rax = 0x55bea3305070
rbx = 0x00000000
rcx = ...
- 9,019
8
votes
Accepted
ELF x86 - Why is return address pushed twice?
It was present on the stack before and esp, 0xfffffff0 instruction that aligns the stack to 16 bytes. This instruction doesn't erase the data that was previously at esp (so ecx-4 still points to the ...
- 3,419
7
votes
Accepted
What could be the purpose of XORing esp with a global variable? (stack canary protection)
Yes, this is an implementation of what's often called "Stack Canaries", a method of stack Buffer Overflow Protection. That example you're describing is specifically the method used by Visual Studio, ...
- 11.8k
7
votes
Why doesn't this retn instruction return from the function?
The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of ...
- 4,952
6
votes
Accepted
Understanding Program Arguments on the Stack in Assembly
First of all, you have to understand that there is a specification for all these things. These specifications differ from one assembly language to another and from one operating system to the other.
...
- 19.2k
5
votes
What could be the purpose of XORing esp with a global variable? (stack canary protection)
Yes, this is Microsoft's stack overflow protection, commonly known as "GS cookie". From Compiler Security Checks In Depth:
When the function is compiled with /GS, the functions prolog will set
...
- 36.9k
5
votes
Accepted
How to find the stack and other info in a memory dump? ARM
The only idea I have is to compare the dumps. The places that are same in all dumps are code or read only data. The places that are changing from dump to dump are either stack or section like .bss. ...
- 8,538
5
votes
Accepted
Remote Debugging Linux Binaries - Stack Address Changes?
On modern Linux machines ASLR is enabled by default. As a result, when the process image for the binary is created in virtual memory, the base address of the stack is located at a random offset:
/*
*...
- 7,236
4
votes
Is there any tool to visually see program stack in linux while debugging?
You can use gdb, for example let see this simple program
#include <stdio.h>
int main(){
printf("hello world\n");
return 0;
}
Compile it
gcc -o simple simple.c -g
Run with gdb
gdb ./...
- 309
4
votes
Is there any tool to visually see program stack in linux while debugging?
please have a look to gef it is incredibly useful and continuously improved. Here some notes from the main github page:
Entirely OS Agnostic, NO dependencies: GEF is battery-included and
is ...
- 141
4
votes
Remote Debugging Linux Binaries - Stack Address Changes?
Most modern operating systems never guaranteed the stack's location will be the same for different process creations to begin with, and this was mostly a byproduct of deterministic execution of those ...
- 11.8k
4
votes
Accepted
Cutter shows addresses relative to stack but not rbp. How to change it?
The two pictures probably show the same binary being analyzed. But the two Cutter versions might not be the same, and that's likely the cause for the discrepancy you see.
Cutter is a front end for ...
- 116
3
votes
Why doesn't this retn instruction return from the function?
My answers:
Why is that? The program you are looking at is probably using some software obfuscation because this is not a usual way to return from a function. My guess is that this function is just ...
- 19.2k
3
votes
Understanding the output of Windbg's `dds esp`
The stack can be used to hold all kinds of values, including ones that look like return addresses but aren't. If stack-frames are omitted, then it becomes very difficult to trace backwards without ...
- 4,709
3
votes
Can we see local variable directly by inspecting the disk image (file in disk)?
First, local variables needn't be stored on the stack. Modern compilers will first try to use CPU registers to store local variables.
Next, heap and stack are terms that relate to virtual memory. ...
- 970
3
votes
Accepted
IDA makes an incorrect guess about how a virtual function affects the stack. How can I correct/override it?
You can use Alt-K shortcut to fix the stack pointer.
Its documentation is here.
- 8,538
3
votes
Accepted
Is stack migration a standard attack technique?
I don't know Chinese but It seems the post describes stack pivoting. It is a technique used in cases where you can't control the contents of the actual stack used by the target but can change the ...
- 36.9k
3
votes
Accepted
Moving xmm0 onto the stack results in a access violation exception
According to definition of the assembly command movdqathe memory operand should be aligned by 16 (see Intel SDM at Vol. 2B 4-63):
When the source or destination operand is a memory operand, the
...
- 8,538
3
votes
Accepted
Passing argument through registers instead of the stack
This behavior is totally normal. The way functions are handled is usually described in what's called an ABI (Application Binary Interface). It defines calling conventions which detail how a call is ...
- 2,673
3
votes
Accepted
Two arguments pushed on stack, callee only shows one argument
Yes, the disassembler is not including it since [ebp+8] is not referenced anywhere in the procedure.
- 1,341
3
votes
Accepted
Is the value of EBP before the main function important?
__libc_start_main is called by the entry point code (usually in a file called crt0.S or similar) and that code usually sets up the initial EBP value (usually to 0, to denote end of the call stack for ...
- 36.9k
3
votes
Accepted
How to examine/edit stack memory contents using radare2 in debug mode?
To examine in radare2 you can think as 'print values' and you can use:
px show hexdump
pxl display N lines (rows) of hexdump
pxr[j] show words with ...
- 521
3
votes
ASLR in Linux Vs Windows
By using this tool from Didier Stevens you've been able to check/set/unset DEP/ASLR characteristics of your file.
Check the file like this:
setdllcharacteristics.exe yourfile.exe
If the output said ...
- 81
3
votes
Accepted
How to calculate value inside stack segment (SS)
Registers ss, cs, ds, es, gs, fs are special. They are called segment registers and contain not addresses but selectors.
A selector is used by the CPU as a reference to a segment - area of memory with ...
- 36.9k
3
votes
Reverse-engineering a 90s CNC machine (FORTH like) firmware
interesting project you've got here and you're giving a good overview - maybe too much (in comparison to most of the other questions here)
i think you need to search for (retired) poeple that got deep ...
- 336
3
votes
Accepted
why some functions push data before the prologue
It's saving registers that might be modified by the function. Notice that you can see assignments to all three of those registers throughout the function body. Also notice at the bottom of your ...
- 9,218
2
votes
Accepted
whats the purpose of this code snippet?
This is most likely an optimized tail call. The original code probably looked similar to this:
int f1()
{
//some code which was optimized out
return f2();// &f2=0x10002135a
}
Since there is no ...
- 36.9k
2
votes
Accepted
Stack variable information removed in IDA pro (free version)?
IDA declares local variables as var_XXX at the start of function
In the paste below var_108 is declared as dword ptr -108h
So 0x10c - 108 = 4
If You hit K
ida would show you
.text:0040115C ...
- 16.7k
Only top scored, non community-wiki answers of a minimum length are eligible