Hot answers tagged

2

How come there are entire rows of other data between the 3 stack strings? First of all, in x64 Linux code, the stack should be aligned to 16 bytes before any function call, so you can expect that rsp will be aligned as such in compiler generated code. Now, it's just a compiler's decision how many bytes it will use for item allocation. In GCC, for instance, ...


2

I assume you are using *nix based systems since you mentioned gdb. If you just want to print the stack/registers when you hit a break point, you can use command to set up some print statements. See here. Installing pwndbg makes it a lot less exhausting as it prints out the stack and registers every time you step, with labels on the stack identifying rbp and ...


2

Registers ss, cs, ds, es, gs, fs are special. They are called segment registers and contain not addresses but selectors. A selector is used by the CPU as a reference to a segment - area of memory with a specific base (start address), limit (end address) and permissions. Selectors and segments are set up by the OS and in theory there may be many different ...


1

In the _start function, argc, argv and envp are contained on the stack. A good read on this is the Linux x86 Program Start Up or - How the heck do we get to main()? When you run a program, the shell or gui calls execve() which executes the linux system call execve(). If you want more information about execve() then you can simply type man execve from your ...


1

Borland's Turbo Debugger also has a text-window-based UI, with the stack in its own window and showing which values in which locations. It doesn't tell you what those values represent, but at least it's always visible.


1

The autor started with 5009 bytes ("TRUN /.:/" + 5000 * 'A') so later when the actual shell code was added to the payload, the code ((5009 - len(payload)) * "C") is added to maintain the original length of the payload that caused the crash. If it works without - great, but why add additional variable/unknown to the pwning equation if you ...


Only top voted, non community-wiki answers of a minimum length are eligible