SlideShare a Scribd company logo

Diving Into Memory Allocation to Understand Buffer Overflow Better

Oguzhan Topgul, profile picture
Oguzhan Topgul

The document discusses dynamic memory allocation in C programs. It explains that programs have different memory sections like the stack, heap, data, and bss. The stack grows downward in memory and is used to store function arguments, local variables, and return addresses. The heap grows upward and is used for dynamic memory allocation via functions like malloc.

Engineering
1 of 45
Downloaded 14 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
MEMORY ALLOCATION DIVING INTO TO UNDERSTAND BUFFER OVERFLOW BETTER
DYNAMIC MEMORY ALLOCATION WHOAMI Oguzhan Topgul Application Security Engineer @FORTINET www.oguzhantopgul.com @oguzhantopgul
DYNAMIC MEMORY ALLOCATION CPU REGISTERS ▸ EIP: Instruction Pointer - Next instruction to be executed ▸ ESP: Stack Pointer - Top of the stack ▸ EBP: Base Pointer - Base of the stack ▸ EAX: Accumulator Register - Generally holds the return value ▸ EBX: Base Register - Generally used to address memory ▸ ECX: Counter Register - Generally used in shift, rotate instructions and loops ▸ EDX: Data Register - Generally used in arithmetic and I/O operations ▸ ESI: Source Index Register ▸ EDI: Destination Index Register
DYNAMIC MEMORY ALLOCATION PROGRAM MEMORY .TEXT .DATA HEAP STACK .BSS LOW MEMORY ADDRESS HIGH MEMORY ADDRESS - a.k.a Code Segment - Executable Instructions - Read-only
DYNAMIC MEMORY ALLOCATION PROGRAM MEMORY .TEXT .DATA HEAP STACK .BSS LOW MEMORY ADDRESS HIGH MEMORY ADDRESS - a.k.a initialized data - global variables w/ pre-defined value - static variables w/ pre-defined value within the functions keeps its value between invocations #include <stdio.h> void foo() { int a = 10; static int sa = 10; a += 5; sa += 5; printf("a = %d, sa = %dn", a, sa); } int main() { int i; for (i = 0; i < 10; ++i) foo(); } a = 15, sa = 15 a = 15, sa = 20 a = 15, sa = 25 a = 15, sa = 30 a = 15, sa = 35 a = 15, sa = 40 a = 15, sa = 45 a = 15, sa = 50 a = 15, sa = 55 a = 15, sa = 60
DYNAMIC MEMORY ALLOCATION PROGRAM MEMORY .TEXT .DATA HEAP STACK .BSS LOW MEMORY ADDRESS HIGH MEMORY ADDRESS - a.k.a uninitialized data - global variables w/o pre-defined value - static variables w/o predefined value within the functions
DYNAMIC MEMORY ALLOCATION PROGRAM MEMORY .TEXT .DATA HEAP STACK .BSS LOW MEMORY ADDRESS HIGH MEMORY ADDRESS - grows low->high - malloc, calloc, realloc, free - shared by all - threads, - shared libraries - dynamically loaded modules
DYNAMIC MEMORY ALLOCATION PROGRAM MEMORY .TEXT .DATA HEAP STACK .BSS LOW MEMORY ADDRESS HIGH MEMORY ADDRESS - LIFO - On x86, stack grows Higher->Lower - What’s stored in Stack: - Function arguments, - Local variables - Function return address - PUSH adds to the top, POP removes from top } Stack Frame
#include <stdio.h> int x = 20; int y; int main() { char buf[5]; for (i = 0; i < 10; ++i) foo(15); } void foo(int arg) { int a = 10; static int sa = 10; sa += 5; char* int = malloc(10 * sizeof(int)); printf("sa = %dn”,sa); } DYNAMIC MEMORY ALLOCATION PROGRAM MEMORY .TEXT .DATA HEAP STACK .BSS LOW MEMORY ADDRESS HIGH MEMORY ADDRESS
double multiplyByTwo (double input) { double twice = input * 2.0; return twice; } int main (int argc, char *argv[]) { int age = 30; double salary = 12345.67; double myList[3] = {1.2, 2.3, 3.4}; printf("salary is %.3fn", multiplyByTwo(salary)); return 0; } DYNAMIC MEMORY ALLOCATION double *multiplyByTwo (double *input) { double *twice = malloc(sizeof(double)); *twice = *input * 2.0; return twice; } int main (int argc, char *argv[]) { int *age = malloc(sizeof(int)); *age = 30; double *salary = malloc(sizeof(double)); *salary = 12345.67; double *myList = malloc(3 * sizeof(double)); myList[0] = 1.2; myList[1] = 2.3; myList[2] = 3.4; double *twiceSalary = multiplyByTwo(salary); printf(“salary is %.3fn", *twiceSalary); free(age); free(salary); free(myList); free(twiceSalary); return 0; } DEFINE VARIABLES ON STACK VS HEAP
DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS - Stack Pointer (SP, ESP) tracks the top of the stack (last address on the stack) - Changes during the execution (PUSH&POP) - Base Pointer (BP, EBP) a.k.a Frame Pointer (FP) shows the bottom of the stack - Fixed during the execution - local variables and arguments are referenced by their offset from EBP EBP ARG 1 ARG 2 LOCAL VAR 2 LOCAL VAR 1 EBP + 8 EBP + 12 EBP - 8 EBP - 4 ESP RETURN ADDREBP + 4
DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret EBP - MAIN ESP
DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3 EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ESP
DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3 EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ARG 2 ESP
DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3 EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ARG 2 ARG 1 ESP
DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3 EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ARG 2 ARG 1 RETURN ADDR ESP EIP { PUSH EIP JMP function
DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3 EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ARG 2 ARG 1 RETURN ADDR EBP - FUNCTION ESP
DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - FUNCTION ARG 1 ARG 2 EBP + 8 EBP + 12 EBP - 8 EBP - 4 RETURN ADDREBP + 4 int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3EBP + 16 EBP - 12 EBP - 16 ESP EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret
DYNAMIC MEMORY ALLOCATIONTEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS ARG 1 ARG 2 RETURN ADDR int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3 EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ESP { RESTORE ALLOCATED MEMORY POP EBP POP RETURN ADDR JMP RETURN ADDR
DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS ARG 1 ARG 2 int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3 EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ESP
DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ESP
TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ESP void function(char *str) { char buffer[16]; strcpy(buffer,str); } int main() { char large_string[256]; int i; for(i = 0; i < 255; i++) large_string[i] = 'A'; function(large_string); }
TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX ESP
TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4
TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0x00
TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0x00
TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0x00
TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0x00
TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0x00 EBP - 276 EBP - 272 EBP - 268
TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0x00 EBP - 276 EBP - 272 EBP - 268 0x41
TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0x01 EBP - 276 EBP - 272 EBP - 268 0x41
TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0xff EBP - 276 EBP - 272 EBP - 268 0x41 }for loop 0x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41
TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0xff EBP - 276 EBP - 272 EBP - 268 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBP - 284 EBP - 288 EBP - 292
TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECXEBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0xff EBP - 268 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 ADDRESS OF EBP-267 ESPEBP - 296
LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECXEBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0xff EBP - 268 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 RETURN ADDR ESP ADDRESS OF EBP-267EBP - 296
00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret HIGH MEMORY ADDRESS EBP - MAIN ECX 0x00 0x00 0x00 0xff 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBX RETURN ADDR ADDRESS OF LARGE_STRING EBP - 4 ESP EBP - FUNCTION
00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret HIGH MEMORY ADDRESS EBP - MAIN ECX 0x00 0x00 0x00 0xff 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBX RETURN ADDR ADDRESS OF LARGE_STRING EBP - 4 . . . EBP - 24 EBP - FUNCTION ESP
00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret HIGH MEMORY ADDRESS EBP - MAIN ECX 0x00 0x00 0x00 0xff 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBP - FUNCTION EBX RETURN ADDR ADDRESS OF LARGE_STRING EBP - 4 . . . EBP - 24 EBP - 28 EBP - 32 ESP
00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret HIGH MEMORY ADDRESS EBP - MAIN ECX 0x00 0x00 0x00 0xff 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBP - FUNCTION EBX RETURN ADDR ADDRESS OF LARGE_STRING EBP - 4 . . . EBP - 24 EBP - 28 EBP - 32 ESP EBP + 8 ADDRESS OF LARGE_STRINGEBP - 36
00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret HIGH MEMORY ADDRESS EBP - MAIN ECX 0x00 0x00 0x00 0xff 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBP - FUNCTION EBX RETURN ADDR ADDRESS OF LARGE_STRING EBP - 4 16 BYTE BUFFER. . . EBP - 24 EBP - 28 EBP - 32 EBP + 8 ADDRESS OF LARGE_STRINGEBP - 36 ADDRESS OF BUFFEREBP - 40 ESP
TEXT STACK JUST BEFORE STRCPY
00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret HIGH MEMORY ADDRESS EBP - MAIN ECX 0x00 0x00 0x00 0xff 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBP - FUNCTION EBX RETURN ADDR ADDRESS OF LARGE_STRING EBP - 4 16 BYTE BUFFER. . . EBP - 24 EBP - 28 EBP - 32 EBP + 8 ADDRESS OF LARGE_STRINGEBP - 36 ADDRESS OF BUFFEREBP - 40 ESP 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
DYNAMIC MEMORY ALLOCATION STACK AFTER STRCPY
DYNAMIC MEMORY ALLOCATION BUFFER OVERFLOW int main() { char large_string[256]; int i; for(i = 0; i < 255; i++) large_string[i] = 'A'; char buffer[16]; strcpy(buffer, large_string); } int main(int argc, char **argv) { char buffer[16]; gets(buffer); } ▸ What happens if you fill the buffer with a user input? ▸ User can enter an input with the length > 16
HIGH MEMORY ADDRESS EBP - MAIN ECX 0x00 0x00 0x00 0xff 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBP - FUNCTION EBX RETURN ADDR ADDRESS OF LARGE_STRING 16 BYTE BUFFER 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 user codemyofAddress 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 USER CODE BUFFER OVERFLOW ▸ Overwrite the return address ▸ Change the program flow DYNAMIC MEMORY ALLOCATION

More Related Content

PDF
php & performance
simon8410
 
PDF
[Cook book] ansible 4_dell emc networking
Jo Hoon
 
PDF
ECMAScript 6
WebF
 
PDF
PHP & Performance
毅 吕
 
ODP
Fabric Fast & Furious edition
Alejandro E Brito Monedero
 
ODP
Basic commands (linux)
Faysal Khan
 
PDF
[Altibase] 9 replication part2 (methods and controls)
altistory
 
PPT
Software Exploitation Techniques by Amit Malik
n|u - The Open Security Community
 
php & performance
simon8410
 
[Cook book] ansible 4_dell emc networking
Jo Hoon
 
ECMAScript 6
WebF
 
PHP & Performance
毅 吕
 
Fabric Fast & Furious edition
Alejandro E Brito Monedero
 
Basic commands (linux)
Faysal Khan
 
[Altibase] 9 replication part2 (methods and controls)
altistory
 
Software Exploitation Techniques by Amit Malik
n|u - The Open Security Community
 

What's hot (20)

ODP
Sahul
sahul azzez m.i
 
ODP
Sahu
sahul azzez m.i
 
PDF
Infrastructure As Code With Terraform
Mystic Coders, LLC
 
PPT
Watch Me Install Alfresco
Alfresco Software
 
TXT
Hadoop installation
Leon Gladston
 
PDF
Ansible leveraging 2.0
bcoca
 
PPTX
Ultimate Unix Meetup Presentation
JacobMenke1
 
ODP
Linux-Fu for PHP Developers
Lorna Mitchell
 
PDF
Hacking ansible
bcoca
 
PPT
PE Packers Used in Malicious Software - Part 2
amiable_indian
 
ODP
Sah
sahul azzez m.i
 
PDF
Setting up a HADOOP 2.2 cluster on CentOS 6
Manish Chopra
 
PDF
関西PHP勉強会 php5.4つまみぐい
Hisateru Tanaka
 
PPTX
How to Save, backup and restore IOS on Cisco router
tcpipguru
 
PDF
Web Audio API + AngularJS
Chris Bateman
 
PPTX
SecZone 2011: Scrubbing SAP clean with SOAP
Chris John Riley
 
PPTX
Mercurial for Kittens
nya3jp
 
PDF
Flask SQLAlchemy
Eueung Mulyana
 
PDF
Building apache modules
Marian Marinov
 
PDF
Exploring Async PHP (SF Live Berlin 2019)
dantleech
 
Sahul
sahul azzez m.i
 
Sahu
sahul azzez m.i
 
Infrastructure As Code With Terraform
Mystic Coders, LLC
 
Watch Me Install Alfresco
Alfresco Software
 
Hadoop installation
Leon Gladston
 
Ansible leveraging 2.0
bcoca
 
Ultimate Unix Meetup Presentation
JacobMenke1
 
Linux-Fu for PHP Developers
Lorna Mitchell
 
Hacking ansible
bcoca
 
PE Packers Used in Malicious Software - Part 2
amiable_indian
 
Sah
sahul azzez m.i
 
Setting up a HADOOP 2.2 cluster on CentOS 6
Manish Chopra
 
関西PHP勉強会 php5.4つまみぐい
Hisateru Tanaka
 
How to Save, backup and restore IOS on Cisco router
tcpipguru
 
Web Audio API + AngularJS
Chris Bateman
 
SecZone 2011: Scrubbing SAP clean with SOAP
Chris John Riley
 
Mercurial for Kittens
nya3jp
 
Flask SQLAlchemy
Eueung Mulyana
 
Building apache modules
Marian Marinov
 
Exploring Async PHP (SF Live Berlin 2019)
dantleech
 
Ad

Similar to Diving Into Memory Allocation to Understand Buffer Overflow Better (20)

PPTX
Reversing malware analysis training part4 assembly programming basics
Cysinfo Cyber Security Community
 
PDF
CNIT 127: Ch 2: Stack Overflows in Linux
Sam Bowne
 
PDF
various tricks for remote linux exploits　 by Seok-Ha Lee (wh1ant)
CODE BLUE
 
PDF
127 Ch 2: Stack overflows on Linux
Sam Bowne
 
PDF
CNIT 127 Ch 2: Stack overflows on Linux
Sam Bowne
 
PPTX
Basic ASM by @binaryheadache
camsec
 
PDF
The Stack and Buffer Overflows
UTD Computer Security Group
 
PDF
CNIT 127: Ch 2: Stack overflows on Linux
Sam Bowne
 
PDF
X86 assembly & GDB
Jian-Yu Li
 
PDF
127 Ch 2: Stack overflows on Linux
Sam Bowne
 
PDF
CNIT 127 Ch 2: Stack overflows on Linux
Sam Bowne
 
PDF
ROP
Jian-Yu Li
 
PPTX
Software to the slaughter
Quinn Wilton
 
PDF
Reverse Engineering Dojo: Enhancing Assembly Reading Skills
Asuka Nakajima
 
TXT
Exploit techniques - a quick review
Ce.Se.N.A. Security
 
PPTX
17
dano2osu
 
PPTX
Return Oriented Programming (ROP chaining)
Abhinav Chourasia, GMOB
 
PDF
ROP 輕鬆談
hackstuff
 
ODP
Exploiting Memory Overflows
Ankur Tyagi
 
PDF
rop heap attacks cfi int overflows computer security
FannyBellows
 
Reversing malware analysis training part4 assembly programming basics
Cysinfo Cyber Security Community
 
CNIT 127: Ch 2: Stack Overflows in Linux
Sam Bowne
 
various tricks for remote linux exploits　 by Seok-Ha Lee (wh1ant)
CODE BLUE
 
127 Ch 2: Stack overflows on Linux
Sam Bowne
 
CNIT 127 Ch 2: Stack overflows on Linux
Sam Bowne
 
Basic ASM by @binaryheadache
camsec
 
The Stack and Buffer Overflows
UTD Computer Security Group
 
CNIT 127: Ch 2: Stack overflows on Linux
Sam Bowne
 
X86 assembly & GDB
Jian-Yu Li
 
127 Ch 2: Stack overflows on Linux
Sam Bowne
 
CNIT 127 Ch 2: Stack overflows on Linux
Sam Bowne
 
ROP
Jian-Yu Li
 
Software to the slaughter
Quinn Wilton
 
Reverse Engineering Dojo: Enhancing Assembly Reading Skills
Asuka Nakajima
 
Exploit techniques - a quick review
Ce.Se.N.A. Security
 
17
dano2osu
 
Return Oriented Programming (ROP chaining)
Abhinav Chourasia, GMOB
 
ROP 輕鬆談
hackstuff
 
Exploiting Memory Overflows
Ankur Tyagi
 
rop heap attacks cfi int overflows computer security
FannyBellows
 
Ad

More from Oguzhan Topgul (7)

PDF
Malicious Word Document Analysis
Oguzhan Topgul
 
PDF
iOS'da Zararlı Yazılım Yok (mu?)
Oguzhan Topgul
 
PDF
Media Files : Android's New Nightmare
Oguzhan Topgul
 
PDF
Androidin Yeni Kabusu: Medya Dosyalari (Media Files: Android's New Nightmare)
Oguzhan Topgul
 
PDF
Geçmişten Günümüze Mobil Zararlı Yazılımlar
Oguzhan Topgul
 
PDF
iOS Güvenlik Mekanizmaları - UNISIP Siber Güvenlik Sempozyumu 2014
Oguzhan Topgul
 
PDF
Android'de Parmak Kaldırmadan Konusmak - İzinsiz Uygulamda İzin Kullanmak Sib...
Oguzhan Topgul
 
Malicious Word Document Analysis
Oguzhan Topgul
 
iOS'da Zararlı Yazılım Yok (mu?)
Oguzhan Topgul
 
Media Files : Android's New Nightmare
Oguzhan Topgul
 
Androidin Yeni Kabusu: Medya Dosyalari (Media Files: Android's New Nightmare)
Oguzhan Topgul
 
Geçmişten Günümüze Mobil Zararlı Yazılımlar
Oguzhan Topgul
 
iOS Güvenlik Mekanizmaları - UNISIP Siber Güvenlik Sempozyumu 2014
Oguzhan Topgul
 
Android'de Parmak Kaldırmadan Konusmak - İzinsiz Uygulamda İzin Kullanmak Sib...
Oguzhan Topgul
 

Recently uploaded (20)

PPTX
KTU 2019 -S7-MCN 401 MODULE 2-VINAY.pptx
VinayB68
 
PPT
Mechanical Engineering MATERIALS Selection
arsalanahmad705384
 
PPTX
CYBER-CRIMES AND SECURITY A guide to understanding
Davies Chacko
 
PDF
July 2025 - Top 10 Read Articles in International Journal of Software Enginee...
sebastianku31
 
PPTX
M Tech Sem 1 Civil Engineering Environmental Sciences.pptx
ShriNRPrasad
 
PPTX
OOP with Java - Java Introduction (Basics)
Rashmi T V
 
PDF
Enhancing Cyber Defense Against Zero-Day Attacks using Ensemble Neural Networks
IJCNCJournal
 
PPTX
Engineering Ethics, Safety and Environment [Autosaved] (1).pptx
MehrabTaseenTalukder
 
PPTX
MCN 401 KTU-2019-PPE KITS-MODULE 2.pptx
VinayB68
 
PDF
The CXO Playbook 2025 – Future-Ready Strategies for C-Suite Leaders Cerebrai...
Cerebraix Technologies
 
PDF
Well-logging-methods_new................
ZafriFarid
 
PDF
BMEC211 - INTRODUCTION TO MECHATRONICS-1.pdf
ryankakungu
 
PDF
PPT on Performance Review to get promotions
prashant593122
 
PPTX
Construction Project Organization Group 2.pptx
vj5agdales
 
PPTX
IOT PPTs Week 10 Lecture Material.pptx of NPTEL Smart Cities contd
ssusera400e8
 
PPTX
Geodesy 1.pptx...............................................
abhi1361yadav
 
PPTX
Lecture Notes Electrical Wiring System Components
eedgecbhojpur
 
PDF
Digital Logic Computer Design lecture notes
CHINNASUNKAIAH1
 
PPT
CRASH COURSE IN ALTERNATIVE PLUMBING CLASS
rene militante
 
PDF
Model Code of Practice - Construction Work - 21102022 .pdf
AinieButt1
 
KTU 2019 -S7-MCN 401 MODULE 2-VINAY.pptx
VinayB68
 
Mechanical Engineering MATERIALS Selection
arsalanahmad705384
 
CYBER-CRIMES AND SECURITY A guide to understanding
Davies Chacko
 
July 2025 - Top 10 Read Articles in International Journal of Software Enginee...
sebastianku31
 
M Tech Sem 1 Civil Engineering Environmental Sciences.pptx
ShriNRPrasad
 
OOP with Java - Java Introduction (Basics)
Rashmi T V
 
Enhancing Cyber Defense Against Zero-Day Attacks using Ensemble Neural Networks
IJCNCJournal
 
Engineering Ethics, Safety and Environment [Autosaved] (1).pptx
MehrabTaseenTalukder
 
MCN 401 KTU-2019-PPE KITS-MODULE 2.pptx
VinayB68
 
The CXO Playbook 2025 – Future-Ready Strategies for C-Suite Leaders Cerebrai...
Cerebraix Technologies
 
Well-logging-methods_new................
ZafriFarid
 
BMEC211 - INTRODUCTION TO MECHATRONICS-1.pdf
ryankakungu
 
PPT on Performance Review to get promotions
prashant593122
 
Construction Project Organization Group 2.pptx
vj5agdales
 
IOT PPTs Week 10 Lecture Material.pptx of NPTEL Smart Cities contd
ssusera400e8
 
Geodesy 1.pptx...............................................
abhi1361yadav
 
Lecture Notes Electrical Wiring System Components
eedgecbhojpur
 
Digital Logic Computer Design lecture notes
CHINNASUNKAIAH1
 
CRASH COURSE IN ALTERNATIVE PLUMBING CLASS
rene militante
 
Model Code of Practice - Construction Work - 21102022 .pdf
AinieButt1
 

Diving Into Memory Allocation to Understand Buffer Overflow Better

  • 1. MEMORY ALLOCATION DIVING INTO TO UNDERSTAND BUFFER OVERFLOW BETTER
  • 2. DYNAMIC MEMORY ALLOCATION WHOAMI Oguzhan Topgul Application Security Engineer @FORTINET www.oguzhantopgul.com @oguzhantopgul
  • 3. DYNAMIC MEMORY ALLOCATION CPU REGISTERS ▸ EIP: Instruction Pointer - Next instruction to be executed ▸ ESP: Stack Pointer - Top of the stack ▸ EBP: Base Pointer - Base of the stack ▸ EAX: Accumulator Register - Generally holds the return value ▸ EBX: Base Register - Generally used to address memory ▸ ECX: Counter Register - Generally used in shift, rotate instructions and loops ▸ EDX: Data Register - Generally used in arithmetic and I/O operations ▸ ESI: Source Index Register ▸ EDI: Destination Index Register
  • 4. DYNAMIC MEMORY ALLOCATION PROGRAM MEMORY .TEXT .DATA HEAP STACK .BSS LOW MEMORY ADDRESS HIGH MEMORY ADDRESS - a.k.a Code Segment - Executable Instructions - Read-only
  • 5. DYNAMIC MEMORY ALLOCATION PROGRAM MEMORY .TEXT .DATA HEAP STACK .BSS LOW MEMORY ADDRESS HIGH MEMORY ADDRESS - a.k.a initialized data - global variables w/ pre-defined value - static variables w/ pre-defined value within the functions keeps its value between invocations #include <stdio.h> void foo() { int a = 10; static int sa = 10; a += 5; sa += 5; printf("a = %d, sa = %dn", a, sa); } int main() { int i; for (i = 0; i < 10; ++i) foo(); } a = 15, sa = 15 a = 15, sa = 20 a = 15, sa = 25 a = 15, sa = 30 a = 15, sa = 35 a = 15, sa = 40 a = 15, sa = 45 a = 15, sa = 50 a = 15, sa = 55 a = 15, sa = 60
  • 6. DYNAMIC MEMORY ALLOCATION PROGRAM MEMORY .TEXT .DATA HEAP STACK .BSS LOW MEMORY ADDRESS HIGH MEMORY ADDRESS - a.k.a uninitialized data - global variables w/o pre-defined value - static variables w/o predefined value within the functions
  • 7. DYNAMIC MEMORY ALLOCATION PROGRAM MEMORY .TEXT .DATA HEAP STACK .BSS LOW MEMORY ADDRESS HIGH MEMORY ADDRESS - grows low->high - malloc, calloc, realloc, free - shared by all - threads, - shared libraries - dynamically loaded modules
  • 8. DYNAMIC MEMORY ALLOCATION PROGRAM MEMORY .TEXT .DATA HEAP STACK .BSS LOW MEMORY ADDRESS HIGH MEMORY ADDRESS - LIFO - On x86, stack grows Higher->Lower - What’s stored in Stack: - Function arguments, - Local variables - Function return address - PUSH adds to the top, POP removes from top } Stack Frame
  • 9. #include <stdio.h> int x = 20; int y; int main() { char buf[5]; for (i = 0; i < 10; ++i) foo(15); } void foo(int arg) { int a = 10; static int sa = 10; sa += 5; char* int = malloc(10 * sizeof(int)); printf("sa = %dn”,sa); } DYNAMIC MEMORY ALLOCATION PROGRAM MEMORY .TEXT .DATA HEAP STACK .BSS LOW MEMORY ADDRESS HIGH MEMORY ADDRESS
  • 10. double multiplyByTwo (double input) { double twice = input * 2.0; return twice; } int main (int argc, char *argv[]) { int age = 30; double salary = 12345.67; double myList[3] = {1.2, 2.3, 3.4}; printf("salary is %.3fn", multiplyByTwo(salary)); return 0; } DYNAMIC MEMORY ALLOCATION double *multiplyByTwo (double *input) { double *twice = malloc(sizeof(double)); *twice = *input * 2.0; return twice; } int main (int argc, char *argv[]) { int *age = malloc(sizeof(int)); *age = 30; double *salary = malloc(sizeof(double)); *salary = 12345.67; double *myList = malloc(3 * sizeof(double)); myList[0] = 1.2; myList[1] = 2.3; myList[2] = 3.4; double *twiceSalary = multiplyByTwo(salary); printf(“salary is %.3fn", *twiceSalary); free(age); free(salary); free(myList); free(twiceSalary); return 0; } DEFINE VARIABLES ON STACK VS HEAP
  • 11. DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS - Stack Pointer (SP, ESP) tracks the top of the stack (last address on the stack) - Changes during the execution (PUSH&POP) - Base Pointer (BP, EBP) a.k.a Frame Pointer (FP) shows the bottom of the stack - Fixed during the execution - local variables and arguments are referenced by their offset from EBP EBP ARG 1 ARG 2 LOCAL VAR 2 LOCAL VAR 1 EBP + 8 EBP + 12 EBP - 8 EBP - 4 ESP RETURN ADDREBP + 4
  • 12. DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret EBP - MAIN ESP
  • 13. DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3 EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ESP
  • 14. DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3 EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ARG 2 ESP
  • 15. DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3 EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ARG 2 ARG 1 ESP
  • 16. DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3 EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ARG 2 ARG 1 RETURN ADDR ESP EIP { PUSH EIP JMP function
  • 17. DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3 EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ARG 2 ARG 1 RETURN ADDR EBP - FUNCTION ESP
  • 18. DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - FUNCTION ARG 1 ARG 2 EBP + 8 EBP + 12 EBP - 8 EBP - 4 RETURN ADDREBP + 4 int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3EBP + 16 EBP - 12 EBP - 16 ESP EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret
  • 19. DYNAMIC MEMORY ALLOCATIONTEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS ARG 1 ARG 2 RETURN ADDR int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3 EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ESP { RESTORE ALLOCATED MEMORY POP EBP POP RETURN ADDR JMP RETURN ADDR
  • 20. DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS ARG 1 ARG 2 int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } ARG 3 EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ESP
  • 21. DYNAMIC MEMORY ALLOCATION STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS int main() { function(1,2,3); } void function(int a, int b, int c) { char buffer1[5]; } EBP - MAIN <function>: push ebp mov ebp,esp sub esp,0x10 call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e6c nop leave ret <main>: push ebp mov ebp,esp call 11ba <__x86.get_pc_thunk.ax> add eax,0x2e5c push 0x3 push 0x2 push 0x1 call 1189 <function> add esp,0xc nop leave ret ESP
  • 22. TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ESP void function(char *str) { char buffer[16]; strcpy(buffer,str); } int main() { char large_string[256]; int i; for(i = 0; i < 255; i++) large_string[i] = 'A'; function(large_string); }
  • 23. TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX ESP
  • 24. TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4
  • 25. TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0x00
  • 26. TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0x00
  • 27. TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0x00
  • 28. TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0x00
  • 29. TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0x00 EBP - 276 EBP - 272 EBP - 268
  • 30. TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0x00 EBP - 276 EBP - 272 EBP - 268 0x41
  • 31. TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0x01 EBP - 276 EBP - 272 EBP - 268 0x41
  • 32. TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0xff EBP - 276 EBP - 272 EBP - 268 0x41 }for loop 0x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41
  • 33. TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECX EBP - 280 ESP EBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0xff EBP - 276 EBP - 272 EBP - 268 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBP - 284 EBP - 288 EBP - 292
  • 34. TEXT STACK LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECXEBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0xff EBP - 268 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 ADDRESS OF EBP-267 ESPEBP - 296
  • 35. LOW MEMORY ADDRESS HIGH MEMORY ADDRESS EBP - MAIN 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret ECXEBP - 4 EBP - 8 EBP - 12 0x00 0x00 0x00 0xff EBP - 268 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 RETURN ADDR ESP ADDRESS OF EBP-267EBP - 296
  • 36. 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret HIGH MEMORY ADDRESS EBP - MAIN ECX 0x00 0x00 0x00 0xff 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBX RETURN ADDR ADDRESS OF LARGE_STRING EBP - 4 ESP EBP - FUNCTION
  • 37. 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret HIGH MEMORY ADDRESS EBP - MAIN ECX 0x00 0x00 0x00 0xff 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBX RETURN ADDR ADDRESS OF LARGE_STRING EBP - 4 . . . EBP - 24 EBP - FUNCTION ESP
  • 38. 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret HIGH MEMORY ADDRESS EBP - MAIN ECX 0x00 0x00 0x00 0xff 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBP - FUNCTION EBX RETURN ADDR ADDRESS OF LARGE_STRING EBP - 4 . . . EBP - 24 EBP - 28 EBP - 32 ESP
  • 39. 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret HIGH MEMORY ADDRESS EBP - MAIN ECX 0x00 0x00 0x00 0xff 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBP - FUNCTION EBX RETURN ADDR ADDRESS OF LARGE_STRING EBP - 4 . . . EBP - 24 EBP - 28 EBP - 32 ESP EBP + 8 ADDRESS OF LARGE_STRINGEBP - 36
  • 40. 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret HIGH MEMORY ADDRESS EBP - MAIN ECX 0x00 0x00 0x00 0xff 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBP - FUNCTION EBX RETURN ADDR ADDRESS OF LARGE_STRING EBP - 4 16 BYTE BUFFER. . . EBP - 24 EBP - 28 EBP - 32 EBP + 8 ADDRESS OF LARGE_STRINGEBP - 36 ADDRESS OF BUFFEREBP - 40 ESP
  • 42. 00001199 <function>: 1199:55 push ebp 119a:89 e5 mov ebp,esp 119c:53 push ebx 119d:83 ec 14 sub esp,0x14 … 11aa:83 ec 08 sub esp,0x8 11ad:ff 75 08 push DWORD PTR [ebp+0x8] 11b0:8d 55 e8 lea edx,[ebp-0x18] 11b3:52 push edx 11b4:89 c3 mov ebx,eax 11b6:e8 75 fe ff ff call 1030 <strcpy@plt> 11bb:83 c4 10 add esp,0x10 11be:90 nop 11bf:8b 5d fc mov ebx,DWORD PTR [ebp-0x4] 11c2:c9 leave 11c3:c3 ret 000011c4 <main>: … 11ce:55 push ebp 11cf:89 e5 mov ebp,esp 11d1:51 push ecx 11d2:81 ec 14 01 00 00 sub esp,0x114 … 11e2:c7 45 f4 00 00 00 00 mov DWORD PTR [ebp-0xc],0x0 11e9:eb 12 jmp 11fd <main+0x39> 11eb:8d 95 f4 fe ff ff lea edx,[ebp-0x10c] 11f1:8b 45 f4 mov eax,DWORD PTR [ebp-0xc] 11f4:01 d0 add eax,edx 11f6:c6 00 41 mov BYTE PTR [eax],0x41 11f9:83 45 f4 01 add DWORD PTR [ebp-0xc],0x1 11fd:81 7d f4 fe 00 00 00 cmp DWORD PTR [ebp-0xc],0xfe 1204:7e e5 jle 11eb <main+0x27> 1206:83 ec 0c sub esp,0xc 1209:8d 85 f4 fe ff ff lea eax,[ebp-0x10c] 120f:50 push eax 1210:e8 84 ff ff ff call 1199 <function> 1215:83 c4 10 add esp,0x10 1218:90 nop 1219:8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 121c:c9 leave 121d:8d 61 fc lea esp,[ecx-0x4] 1220:c3 ret HIGH MEMORY ADDRESS EBP - MAIN ECX 0x00 0x00 0x00 0xff 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBP - FUNCTION EBX RETURN ADDR ADDRESS OF LARGE_STRING EBP - 4 16 BYTE BUFFER. . . EBP - 24 EBP - 28 EBP - 32 EBP + 8 ADDRESS OF LARGE_STRINGEBP - 36 ADDRESS OF BUFFEREBP - 40 ESP 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
  • 44. DYNAMIC MEMORY ALLOCATION BUFFER OVERFLOW int main() { char large_string[256]; int i; for(i = 0; i < 255; i++) large_string[i] = 'A'; char buffer[16]; strcpy(buffer, large_string); } int main(int argc, char **argv) { char buffer[16]; gets(buffer); } ▸ What happens if you fill the buffer with a user input? ▸ User can enter an input with the length > 16
  • 45. HIGH MEMORY ADDRESS EBP - MAIN ECX 0x00 0x00 0x00 0xff 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 . . . 0x410x410x410x41 EBP - FUNCTION EBX RETURN ADDR ADDRESS OF LARGE_STRING 16 BYTE BUFFER 0x410x410x410x41 0x410x410x410x41 0x410x410x410x41 user codemyofAddress 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 USER CODE BUFFER OVERFLOW ▸ Overwrite the return address ▸ Change the program flow DYNAMIC MEMORY ALLOCATION