understanding buffer overflows
[email protected] 31 Oct 2007 14:36:22 -0000
| Newsgroups | gmane.comp.security.vulnerabilities |
|---|---|
| Message-ID | <[email protected]> |
hello, my name is michael, im from austria - so my english is very bad.=0D
=0D
A few days ago i begin to experiment with bufferoverflows in linux.=0D
=0D
i wrote a little c++ programm like this:=0D
=0D
#include <string.h>=0D
=0D
void main()=0D
{=0D
char buffer[10];=0D
char COPY[]=3D"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...";=0D
strcpy((char *)buffer,(char *)COPY);=0D
=0D
}=0D
=0D
k, this works very well, i got a core dump and have startet gdb. but in t=
he output from "info all" was eip not overwritten=0D
=0D
so i put a few lines in the program to output addresses from functions an=
d variables.=0D
=0D
addresses from functions where over 0 (eg (dec)500000) and addresses from=
vars under 0 (eg -5000000)=0D
=0D
i think this is maybe the problem - but why?=0D
=0D
output from gdb:=0D
=0D
eax 0x0 0=0D
ecx 0x41414141 1094795585=0D
edx 0x1d7 471=0D
ebx 0xb7e27ff4 -1209892876=0D
esp 0x4141413d 0x4141413d=0D
ebp 0x41414141 0x41414141=0D
esi 0xb7f77ce0 -1208517408=0D
edi 0x0 0=0D
eip 0x80484ad 0x80484ad=0D
eflags 0x210286 [ PF SF IF RF ID ]=0D
cs 0x73 115=0D
ss 0x7b 123=0D
ds 0x7b 123=0D
es 0x7b 123=0D
fs 0x0 0=0D
gs 0x33 51 =0D
=0D
=0D
hope anybody can help me understand/learn.=0D
=0D
greets from austria, michael