Author Topic: Simple BO/Memory Question  (Read 669 times)

0 Members and 2 Guests are viewing this topic.

Offline Matriplex

  • Knight
  • **
  • Posts: 323
  • Cookies: 66
  • Java
    • View Profile
Simple BO/Memory Question
« on: June 25, 2014, 02:51:28 am »
I've decided to take a little vacation from my regular programming and get back into hacking a bit as I have a little bit of free time now. So I'm studing program exploitation now, and will be doing so for probably the next few months.

So I have a small program I am exploiting with a buffer overflow attack. There's an array "char array[8]", which is the vulnerability because I can send data to it. In order for it to overflow, I need to send exactly 16 characters. However, this makes no sense to me because afaik, a char takes up one byte. Therefore I should only have to send 8 characters, but instead I have to send double that amount.

Could someone explain the reason I have to send this particular amount?

Thanks.

Edit:
After a bit more in depth reading and testing, I've discovered that when that line is run the compiler creates 16 bytes of space for the variable (sub $0x10, %rsp). So now I understand why I have to put 16 characters in, however I still don't get why it creates that much space.
« Last Edit: June 25, 2014, 04:06:49 am by Matriplex »
\x64\x6F\x75\x65\x76\x65\x6E\x00

Offline Matriplex

  • Knight
  • **
  • Posts: 323
  • Cookies: 66
  • Java
    • View Profile
Re: Simple BO/Memory Question
« Reply #1 on: June 26, 2014, 01:05:34 am »
Hate to double post, but I am quite curious about this particular question.
\x64\x6F\x75\x65\x76\x65\x6E\x00

Offline Matriplex

  • Knight
  • **
  • Posts: 323
  • Cookies: 66
  • Java
    • View Profile
Re: Simple BO/Memory Question
« Reply #2 on: June 26, 2014, 01:48:51 am »
That makes sense, thanks.
Is there any way to tell exactly how much you really need short of trial and error or an automated script?
\x64\x6F\x75\x65\x76\x65\x6E\x00

Offline Matriplex

  • Knight
  • **
  • Posts: 323
  • Cookies: 66
  • Java
    • View Profile
Re: Simple BO/Memory Question
« Reply #3 on: June 26, 2014, 02:33:48 am »
Great, I'll check it out. Thanks for the help.

I also just discovered that your signature is a dick. Hats off to you sir.
\x64\x6F\x75\x65\x76\x65\x6E\x00

Offline proxx

  • Avatarception
  • Global Moderator
  • Titan
  • *
  • Posts: 2803
  • Cookies: 256
  • ФФФ
    • View Profile
Re: Simple BO/Memory Question
« Reply #4 on: June 26, 2014, 07:58:30 am »
Anytime and good luck :)

Also, I own the email 0x@383d3d44.com lol
You shouldnt post you email address in public bro.
Wtf where you thinking with that signature? - Phage.
This was another little experiment *evillaughter - Proxx.
Evilception... - Phage