hi,
so langsam werde ich zum Top-Fragesteller, ist aber keine Absicht :-)
erstmal der Quelltext:
PHP-Code:
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[]) {
int value = 5;
char buffer_one[8], buffer_two[8];
strcpy(buffer_one, "one"); /* put "one" into buffer_one */
strcpy(buffer_two, "two"); /* put "two" into buffer_two */
printf("[BEFORE] buffer_two is at %p and contains \'%s\'\n", buffer_two, buffer_two);
printf("[BEFORE] buffer_one is at %p and contains \'%s\'\n", buffer_one, buffer_one);
printf("[BEFORE] value is at %p and is %d (0x%08x)\n", &value, value, value);
printf("\n[STRCPY] copying %d bytes into buffer_two\n\n", strlen(argv[1]));
strcpy(buffer_two, argv[1]); /* copy first argument into buffer_two */
printf("[AFTER] buffer_two is at %p and contains \'%s\'\n", buffer_two, buffer_two);
printf("[AFTER] buffer_one is at %p and contains \'%s\'\n", buffer_one, buffer_one);
printf("[AFTER] value is at %p and is %d (0x%08x)\n", &value, value, value);
}
Wenn ich mein SuSE 11.2 nehme, tippe ich flogendes ein:
PHP-Code:
tomycat@linux-a4gd:~/hacking> ./overflow_example $(perl -e 'print "A"x16 . "\xef\xbe\xad\xde"')
[BEFORE] buffer_two is at 0xbfffef0c and contains 'two'
[BEFORE] buffer_one is at 0xbfffef14 and contains 'one'
[BEFORE] value is at 0xbfffef1c and is 5 (0x00000005)
[STRCPY] copying 20 bytes into buffer_two
[AFTER] buffer_two is at 0xbfffef0c and contains 'AAAAAAAAAAAAAAAAﾭ�'
[AFTER] buffer_one is at 0xbfffef14 and contains 'AAAAAAAAﾭ�'
[AFTER] value is at 0xbfffef1c and is -559038737 (0xdeadbeef)
tomycat@linux-a4gd:~/hacking>
Es stimmt alles, Live CD + Buch ergänzten sich 1a.
Wenn ich die Suse 12.1 nehme muss ich nicht print"A"x20 sondern nur print"A"x16 eintippen.
Erst dann komme ich auf den gleichen Effekt.
Warum ist das so?
Zitieren
Zitat von retak
