Bug Hunter Diary

the buffer, the SFP, the RET, and adjacent stack memory. If the functionthen returns, we control the value of RET, which gives us controlover the instruction pointer (EIP register).Stack beforethe overflowStack afterthe overflowsaved return addressRETRETEIP controlstack frameof overflow()SFPbufothermetadataSFPbufuser-controlledinput datalower addressesFigure A‐1: Stack frame illustrating a buffer overflowExample: Stack Buffer Overflow Under LinuxTo test the program from Listing A-1 under Linux (Ubuntu 9.04), Icompiled it without stack canary support (see Section C.1):linux$ gcc -fno-stack-protector -o stackoverflow stackoverflow.cThen, I started the program in the debugger (see Section B.4 formore information about gdb) while supplying 20 bytes of user inputas a command-line argument (12 bytes to fill the stack buffer plus4 bytes for the SFP plus 4 bytes for the RET):linux$ gdb -q ./stackoverflow(gdb) run $(perl -e 'print "A"x12 . "B"x4 . "C"x4')Starting program: /home/tk/BHD/stackoverflow $(perl -e 'print "A"x12 . "B"x4 ."C"x4')Program received signal SIGSEGV, Segmentation fault.0x43434343 in ?? ()(gdb) info registerseax 0xbfab9fac -1079271508ecx 0xbfab9fab -1079271509edx 0x15 21ebx 0xb8088ff4 -1207398412esp 0xbfab9fc0 0xbfab9fc0ebp 0x42424242 0x42424242esi 0x8048430 134513712edi 0x8048310 134513424Hints for Hunting 151