impossible to write on stack (stack overflow)

Question

I was experimenting some security stuff and especially trying to understand a ret2ret exploit. The code I was experimentating on : ``` void foo(char * val){ char buffer[64]; int i; for (i=0; val[i]!=0; i++) buffer[i]=val[i]; return; } int main(int argc, char ** argv) { foo(argv[1]); return 0; } ``` ASLR, N^X and stack canaries were off during my test. And I compiled it in 32 bits with gcc. I don't know why but I couldn't get the usual "0x41414141 in ?? ()" saying that I had overwritten $eip. So I decided to debug with gdb and put a breakpoint on the ret in the function "cop" and strangely enough even after writting more than 300 "A" the stack was like this: ``` 0xbffff46c: 0xb7ee2290 0xbffff496 0xb7e8f5f5 0x41414141 0xbffff47c: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffff48c: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffff49c: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffff4ac: 0x41414141 0x41414141 0x41414141 0x00410043 ``` The 64 chars corresponding to the buffer are…

Accepted Answer

I think I figured it out, at least for the 64 buffer. Your counting variable i is located higher on the stack than your buffer (per your disassembly).That means, your 65th store changes the value of i. Note that it won't be the entire value of i as it is probably a 4 byte integer; so only the lower byte (little-endian). In any case, after, it's as if you counted up i enough that the next write (66) should point to the area populated by the environmental variables (past ret), which is harmless and doesn't pollute eip.

My batts are almost done, and I can't finish this rigorously. But think along these lines.

Edit/crossing batt fingers: also, the 66th write might already pull in a 0 as both sides are affected by the pollution of i (where you store it in relative to &buffer; where you read it from relative to argv[1][0].

impossible to write on stack (stack overflow)

Solution

Problem