Expand|Select|Wrap|Line Numbers
- root@Brien:~# gcc -g -o ./stack_example stack_example.c
- root@Brien:~# gdb -q ./stack_example
- Reading symbols from /root/stack_example...done.
- (gdb) list
- 3 void test_function(int a, int b, int c, int d) {
- 4 int flag;
- 5 char buffer[10];
- 6
- 7 flag=31337;
- 8 buffer[0] = 'A';
- 9 }
- 10
- 11 int main() {
- 12 test_function(1, 2, 3, 4);
- (gdb)
- (gdb) disass main
- Dump of assembler code for function main:
- 0x00000000004004c9 <+0>: push rbp
- 0x00000000004004ca <+1>: mov rbp,rsp
- 0x00000000004004cd <+4>: mov ecx,0x4
- 0x00000000004004d2 <+9>: mov edx,0x3
- 0x00000000004004d7 <+14>: mov esi,0x2
- 0x00000000004004dc <+19>: mov edi,0x1
- 0x00000000004004e1 <+24>: call 0x4004ac <test_function>
- 0x00000000004004e6 <+29>: pop rbp
- 0x00000000004004e7 <+30>: ret
- End of assembler dump.
- (gdb) disass test_function
- Dump of assembler code for function test_function:
- 0x00000000004004ac <+0>: push rbp
- 0x00000000004004ad <+1>: mov rbp,rsp
- 0x00000000004004b0 <+4>: mov DWORD PTR [rbp-0x14],edi
- 0x00000000004004b3 <+7>: mov DWORD PTR [rbp-0x18],esi
- 0x00000000004004b6 <+10>: mov DWORD PTR [rbp-0x1c],edx
- 0x00000000004004b9 <+13>: mov DWORD PTR [rbp-0x20],ecx
- 0x00000000004004bc <+16>: mov DWORD PTR [rbp-0x4],0x7a69
- 0x00000000004004c3 <+23>: mov BYTE PTR [rbp-0x10],0x41
- 0x00000000004004c7 <+27>: pop rbp
- (gdb) break 12
- Breakpoint 1 at 0x4004cd: file stack_example.c, line 12.
- (gdb) break test_function
- Breakpoint 2 at 0x4004bc: file stack_example.c, line 7.
- (gdb) run
- Starting program: /root/stack_example
- warning: no loadable sections found in added symbol-file system-supplied DSO at 0x7ffff7ffa000
Expand|Select|Wrap|Line Numbers
- Breakpoint 1, main () at stack_example.c:12
- 12 test_function(1, 2, 3, 4);
- (gdb) i r rsp rbp rip
- rsp 0x7fffffffe3a0 0x7fffffffe3a0
- rbp 0x7fffffffe3a0 0x7fffffffe3a0
- rip 0x4004cd 0x4004cd <main+4>
- (gdb) x/5i $rip
- => 0x4004cd <main+4>: mov ecx,0x4
- 0x4004d2 <main+9>: mov edx,0x3
- 0x4004d7 <main+14>: mov esi,0x2
- 0x4004dc <main+19>: mov edi,0x1
- 0x4004e1 <main+24>: call 0x4004ac <test_function>
- (gdb) cont
- Continuing.
- Breakpoint 2, test_function (a=1, b=2, c=3, d=4) at stack_example.c:7
- 7 flag=31337;
- (gdb) i r rsp rbp rip
- rsp 0x7fffffffe390 0x7fffffffe390
- rbp 0x7fffffffe390 0x7fffffffe390
- rip 0x4004bc 0x4004bc <test_function+16>
- (gdb) disass test_function
- Dump of assembler code for function test_function:
- 0x00000000004004ac <+0>: push rbp
- 0x00000000004004ad <+1>: mov rbp,rsp
- 0x00000000004004b0 <+4>: mov DWORD PTR [rbp-0x14],edi
- 0x00000000004004b3 <+7>: mov DWORD PTR [rbp-0x18],esi
- 0x00000000004004b6 <+10>: mov DWORD PTR [rbp-0x1c],edx
- 0x00000000004004b9 <+13>: mov DWORD PTR [rbp-0x20],ecx
- => 0x00000000004004bc <+16>: mov DWORD PTR [rbp-0x4],0x7a69
- 0x00000000004004c3 <+23>: mov BYTE PTR [rbp-0x10],0x41
- 0x00000000004004c7 <+27>: pop rbp
- 0x00000000004004c8 <+28>: ret
- End of assembler dump.
- (gdb) print $rbp-0x4
- $1 = (void *) 0x7fffffffe38c
- (gdb) print $rbp-0x10
- $2 = (void *) 0x7fffffffe380
- (gdb) x/16xw $rbp
- 0x7fffffffe390: 0xffffe3a0 0x00007fff 0x004004e6 0x00000000
- 0x7fffffffe3a0: 0x00000000 0x00000000 0xf7a70ead 0x00007fff
- 0x7fffffffe3b0: 0x00000000 0x00000000 0xffffe488 0x00007fff
- 0x7fffffffe3c0: 0x00000000 0x00000001 0x004004c9 0x00000000
this seems incorrect beacuse according to FILO 0x7fffffffe3c0: from L to R 1,2,3,4 in hex
0x7fffffffe3b0: from R to L should conatin return address, SFP (which should be 0x7fffffffe3a0,not 0xffffe488), flag and buffer.