// Titolo: dati per la creazione del tutorial "Stack in azione" Pag.02 // Autore: Saio // Data: Marzo 2005 // Tools: Linux mandrake 8.2 su Pentium 166mmx con 128MB di ram (acquistato nel 1997) // // modifica del ret a partire da buffer1 ///////////////////////////////////////// void function(int a, int b, int c) { char buffer1[5]; char buffer2[10]; int *k; printf("buffer1= %p\n",buffer1); printf("buffer2= %p\n",buffer2); k=buffer1+28; *k=0x8048255; } void main(){ int x; x=0; function (1,2,3); x=1; printf("\n%d\n\n",x); } //////////////////////////////////////// [root@localhost phrack-49]# gcc -static example3-saio.c -o example3-saio [root@localhost phrack-49]# gdb example3-saio GNU gdb 5.1.1 Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-mandrake-linux"... (gdb) disassemble main Dump of assembler code for function main: 0x8048230
: push %ebp 0x8048231 : mov %esp,%ebp 0x8048233 : sub $0x8,%esp 0x8048236 : movl $0x0,0xfffffffc(%ebp) 0x804823d : sub $0x4,%esp 0x8048240 : push $0x3 0x8048242 : push $0x2 0x8048244 : push $0x1 0x8048246 : call 0x80481e0 0x804824b : add $0x10,%esp 0x804824e : movl $0x1,0xfffffffc(%ebp) 0x8048255 : sub $0x8,%esp 0x8048258 : pushl 0xfffffffc(%ebp) 0x804825b : push $0x80921a2 0x8048260 : call 0x8048720 0x8048265 : add $0x10,%esp 0x8048268 : mov %ebp,%esp 0x804826a : pop %ebp 0x804826b : ret 0x804826c : lea 0x0(%esi,1),%esi End of assembler dump. (gdb) disassemble function Dump of assembler code for function function: 0x80481e0 : push %ebp 0x80481e1 : mov %esp,%ebp 0x80481e3 : sub $0x38,%esp 0x80481e6 : sub $0x8,%esp 0x80481e9 : lea 0xffffffe8(%ebp),%eax 0x80481ec : push %eax 0x80481ed : push $0x8092188 0x80481f2 : call 0x8048720 0x80481f7 : add $0x10,%esp 0x80481fa : sub $0x8,%esp 0x80481fd : lea 0xffffffd8(%ebp),%eax 0x8048200 : push %eax 0x8048201 : push $0x8092195 0x8048206 : call 0x8048720 0x804820b : add $0x10,%esp 0x804820e : lea 0xffffffe8(%ebp),%eax 0x8048211 : add $0x1c,%eax 0x8048214 : mov %eax,0xffffffd4(%ebp) 0x8048217 : mov 0xffffffd4(%ebp),%eax 0x804821a : movl $0x8048255,(%eax) 0x8048220 : mov %ebp,%esp 0x8048222 : pop %ebp ---Type to continue, or q to quit--- 0x8048223 : ret 0x8048224 : lea 0x0(%esi),%esi 0x804822a : lea 0x0(%edi),%edi End of assembler dump. (gdb) break *0x80481e1 Breakpoint 1 at 0x80481e1 (gdb) break *0x80481e3 Breakpoint 2 at 0x80481e3 (gdb) break *0x80481e6 Breakpoint 3 at 0x80481e6 (gdb) run Starting program: /home/saio/Desktop/buffer/phrack-49/example3-saio Breakpoint 1, 0x080481e1 in function () (gdb) info registers eax 0xbffff9ec -1073743380 ecx 0x80480b4 134512820 edx 0x80a7c08 134904840 ebx 0x8092160 134816096 esp 0xbffff958 0xbffff958 ebp 0xbffff978 0xbffff978 esi 0xbffff9e4 -1073743388 edi 0x1 1 eip 0x80481e1 0x80481e1 eflags 0x296 662 cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x0 0 fctrl 0x37f 895 fstat 0x0 0 ftag 0xffff 65535 fiseg 0x0 0 fioff 0x0 0 foseg 0x0 0 fooff 0x0 0 ---Type to continue, or q to quit--- fop 0x0 0 xmm0 0xffffffffffffffffffffffffffffffff xmm1 0xffffffffffffffffffffffffffffffff xmm2 0xffffffffffffffffffffffffffffffff xmm3 0xffffffffffffffffffffffffffffffff xmm4 0xffffffffffffffffffffffffffffffff xmm5 0xffffffffffffffffffffffffffffffff xmm6 0xffffffffffffffffffffffffffffffff xmm7 0xffffffffffffffffffffffffffffffff mxcsr 0x1f80 8064 (gdb) continue Continuing. Breakpoint 2, 0x080481e3 in function () (gdb) info registers eax 0xbffff9ec -1073743380 ecx 0x80480b4 134512820 edx 0x80a7c08 134904840 ebx 0x8092160 134816096 esp 0xbffff958 0xbffff958 ebp 0xbffff958 0xbffff958 esi 0xbffff9e4 -1073743388 edi 0x1 1 eip 0x80481e3 0x80481e3 eflags 0x296 662 cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x0 0 fctrl 0x37f 895 fstat 0x0 0 ftag 0xffff 65535 fiseg 0x0 0 fioff 0x0 0 foseg 0x0 0 fooff 0x0 0 ---Type to continue, or q to quit--- fop 0x0 0 xmm0 0xffffffffffffffffffffffffffffffff xmm1 0xffffffffffffffffffffffffffffffff xmm2 0xffffffffffffffffffffffffffffffff xmm3 0xffffffffffffffffffffffffffffffff xmm4 0xffffffffffffffffffffffffffffffff xmm5 0xffffffffffffffffffffffffffffffff xmm6 0xffffffffffffffffffffffffffffffff xmm7 0xffffffffffffffffffffffffffffffff mxcsr 0x1f80 8064 (gdb) continue Continuing. Breakpoint 3, 0x080481e6 in function () (gdb) info registers eax 0xbffff9ec -1073743380 ecx 0x80480b4 134512820 edx 0x80a7c08 134904840 ebx 0x8092160 134816096 esp 0xbffff920 0xbffff920 ebp 0xbffff958 0xbffff958 esi 0xbffff9e4 -1073743388 edi 0x1 1 eip 0x80481e6 0x80481e6 eflags 0x282 642 cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x0 0 fctrl 0x37f 895 fstat 0x0 0 ftag 0xffff 65535 fiseg 0x0 0 fioff 0x0 0 foseg 0x0 0 fooff 0x0 0 ---Type to continue, or q to quit--- fop 0x0 0 xmm0 0xffffffffffffffffffffffffffffffff xmm1 0xffffffffffffffffffffffffffffffff xmm2 0xffffffffffffffffffffffffffffffff xmm3 0xffffffffffffffffffffffffffffffff xmm4 0xffffffffffffffffffffffffffffffff xmm5 0xffffffffffffffffffffffffffffffff xmm6 0xffffffffffffffffffffffffffffffff xmm7 0xffffffffffffffffffffffffffffffff mxcsr 0x1f80 8064 (gdb) continue Continuing. buffer1= 0xbffff940 buffer2= 0xbffff930 0 (gdb)q // modifica del ret a partire da buffer2 ///////////////////////////////////////// void function(int a, int b, int c) { char buffer1[5]; char buffer2[10]; int *k; printf("buffer1= %p\n",buffer1); printf("buffer2= %p\n",buffer2); k=buffer2+44; *k=0x8048255; } void main(){ int x; x=0; function (1,2,3); x=1; printf("\n%d\n\n",x); } //////////////////////////////////////// [root@localhost phrack-49]# gdb example3-saio (gdb) break *0x80481e3 Breakpoint 1 at 0x80481e3 (gdb) break *0x80481e6 Breakpoint 2 at 0x80481e6 (gdb) break *0x80481e9 Breakpoint 3 at 0x80481e9 (gdb) run Starting program: /home/saio/Desktop/buffer/phrack-49/example3-saio Breakpoint 1, 0x080481e3 in function () (gdb) continue Continuing. Breakpoint 2, 0x080481e6 in function () (gdb) continue Continuing. Breakpoint 3, 0x080481e9 in function () (gdb) continue Continuing. buffer1= 0xbffff940 buffer2= 0xbffff930 0 (gdb) continue