Software security / memory safety¶
Title: Stack0¶
First I tried 64 A’s, but the program said “Try again?”. So I tried 65 A’s. This time the input was too long and the program changed the modified variable.¶
What happend ?¶
The input was bigger than the buffer because of that the program overwrote the variable called modified.¶
What does “Segmentation fault” mean?¶
A segmentation fault happens when a program tries to access memory that it is not allowed to use. The operating system stops the program to prevent errors.¶
Stack1¶
What happened?¶
I ran ./stack1 without an argument. The program printed “please specify an argument”. This showed that the program needs a command-line argument then I opened the program in GDB and used disassemble main. I found that the program compares the value with 0x61626364.After that I used 64 A characters followed by dcba. The program printed: “you have correctly got the variable to the right value”.¶
What does “little endian” mean?¶
Little endian means that a computer stores the lowest byte first in memory. Because of that, I entered dcba so the value in memory became 0x61626364.¶
Why didn’t you get a segmentation fault?¶
I only changed the modified variable. I did not overwrite the return address or other important memory, so the program continued running normally.¶
Stack3¶
How can you input hex values that don’t correspond to keyboard letters?¶
I used a Python script. Python can print hexadecimal byte values like \x24 that cannot be typed directly on the keyboard.¶
Explain what happened.¶
I found the address of the win function with objdump. Then I created an input with 64 A characters followed by the address of win in little-endian format. The input overwrote the function pointer and the program jumped to the win function. The program printed “code flow successfully changed”.¶
“What is little endian?”¶
Little endian means that the lowest byte is stored first in memory. Because of that, the address had to be written in reverse byte order.¶
