Problem while exploiting with gdb

L00PeR
6 years ago

0

Hi, I’m reading Hacking, The Art of Exploitation and I have a problem with GDB.
Let me put you in situation:
I have a file called bufferoverflow01 which as you can imagine, can be exploited.
So I run:
gdb -q ./bufferoverflow01
Then, so I can read the memory I type:
disas main
And when I’m going to set the breakpoint I see one weird thing:
0x0000000000400626 <+0>: push rbp 0x0000000000400627 <+1>: mov rbp,rsp 0x000000000040062a <+4>: sub rsp,0x40 0x000000000040062e <+8>: mov DWORD PTR [rbp-0x34],edi 0x0000000000400631 <+11>: mov QWORD PTR [rbp-0x40],rsi 0x0000000000400635 <+15>: mov rax,QWORD PTR fs:0x28 0x000000000040063e <+24>: mov QWORD PTR [rbp-0x8],rax 0x0000000000400642 <+28>: xor eax,eax 0x0000000000400644 <+30>: mov DWORD PTR [rbp-0x24],0x5 0x000000000040064b <+37>: lea rax,[rbp-0x20] 0x000000000040064f <+41>: mov DWORD PTR [rax],0x656e6f 0x0000000000400655 <+47>: lea rax,[rbp-0x10] 0x0000000000400659 <+51>: mov DWORD PTR [rax],0x6f7774 0x000000000040065f <+57>: lea rdx,[rbp-0x10] 0x0000000000400663 <+61>: lea rax,[rbp-0x10] 0x0000000000400667 <+65>: mov rsi,rax 0x000000000040066a <+68>: mov edi,0x4007e8 0x000000000040066f <+73>: mov eax,0x0 0x0000000000400674 <+78>: call 0x400500 <printf@plt> 0x0000000000400679 <+83>: lea rdx,[rbp-0x20] 0x000000000040067d <+87>: lea rax,[rbp-0x20] 0x0000000000400681 <+91>: mov rsi,rax
Which are this weird memory numbers???
The are not supposed to start with 0xbf ?
Ok, so after this I try to continue, I set the breakpoint, and when I try to red the memory with:
x/200xw $esp
returns me:
0xffffffffffffdc00: Cannot access memory at address 0xffffffffffffdc00
Please someone help me.

Human Stupidity , thats why Hackers always win.
? Med Amine Khelifi

1reply

2voices

352views

dloser
6 years ago

1

Why are they weird numbers? They look fine to me. Besides, they are just numbers, they have no special meaning.

The “starting with 0xbf” thing is probably based on where the stack is usually located. What you are looking at is not the stack, though.

And the reason you get the error is because you are on a 64-bit system and you are probably reading an example for a 32-bit system. ESP is the 32-bit register for the stack pointer or, in this case, the lower 32 bits of the full 64-bit stack pointer register RSP. Try using ‘$rsp’ instead.

You must be logged in to reply to this discussion. Login

1 of 2