How to write a buffer-overflow exploit in GCC,windows XP,x86?

Question

``` void function(int a, int b, int c) { char buffer1[5]; char buffer2[10]; int *ret; ret = buffer1 + 12; (*ret) += 8;//why is it 8?? } void main() { int x; x = 0; function(1,2,3); x = 1; printf("%d ",x); } ``` The above demo is from here: http://insecure.org/stf/smashstack.html But it's not working here: ``` D: est>gcc -Wall -Wextra hw.cpp && a.exe hw.cpp: In function `void function(int, int, int)': hw.cpp:6: warning: unused variable 'buffer2' hw.cpp: At global scope: hw.cpp:4: warning: unused parameter 'a' hw.cpp:4: warning: unused parameter 'b' hw.cpp:4: warning: unused parameter 'c' 1 ``` And I don't understand why it's 8 though the author thinks: A little math tells us the distance is 8 bytes. My gdb dump as called: ``` Dump of assembler code for function main: 0x004012ee : push %ebp 0x004012ef : mov %esp,%ebp 0x004012f1 : sub $0x18,%esp 0x004012f4 : and $0xfffffff0,%esp 0x004012f7 : mov $0x0,%eax 0x004012fc : add $0xf,%eax 0x004…

Accepted Answer

As joveha pointed out, the value of EIP saved on the stack (return address) by the `call` instruction needs to be incremented by 7 bytes (`0x00401342` - `0x0040133b` = 7) in order to skip the `x = 1;` instruction (`movl $0x1,0xfffffffc(%ebp)`).

You are correct that 56 bytes are being reserved for local variables (`sub $0x38,%esp`), so the missing piece is how many bytes past `buffer1` on the stack is the saved EIP.

A bit of test code and inline assembly tells me that the magic value is 28 for my test. I cannot provide a definitive answer as to why it is 28, but I would assume the compiler is adding padding and/or stack canaries.

The following code was compiled using GCC 3.4.5 (MinGW) and tested on Windows XP SP3 (x86).

```
unsigned long get_ebp() {
   __asm__("pop %ebp
	"
           "movl %ebp,%eax
	"
           "push %ebp
	");
}

void function(int a, int b, int c) {
   char buffer1[5];
   char buffer2[10];
   int *ret;

/* distance in bytes from buffer1 to return address on the stack */
   printf("test %d
", ((get_ebp() + 4) - (unsigned long)&buffer1));

ret = (int *)(buffer1 + 28);

(*ret) += 7;
}

void main() {
   int x;

x = 0;
   function(1,2,3);
   x = 1;
   printf("%d
",x);
}
```

I could have just as easily used gdb to determine this value.

(compiled w/ `-g` to include debug symbols)

```
(gdb) break function
...
(gdb) run
...
(gdb) p $ebp
$1 = (void *) 0x22ff28
(gdb) p &buffer1
$2 = (char (*)[5]) 0x22ff10
(gdb) quit
```

(`0x22ff28` + 4) - `0x22ff10` = 28

(ebp value + size of word) - address of buffer1 = number of bytes

In addition to Smashing The Stack For Fun And Profit, I would suggest reading some of the articles I mentioned in my answer to a previous question of yours and/or other material on the subject. Having a good understanding of exactly how this type of exploit works should help you write more secure code.

How to write a buffer-overflow exploit in GCC,windows XP,x86?

Solution

Problem