Hello
Thanks for the reply
This is the entire program:
Code:
/* overflow.cpp */
#include <iostream>
using namespace std;
int main (int argc, char* argv[])
{
char name[15];
if ( argc < 2)
{
fprintf (stderr, "Usage:\n%s <string>", argv[0]);
exit(-1);
}
cout << "This is a buffer overflow example." << endl;
cout << "If string buffer will exceed 15 bytes, it will cause an
overflow." << endl;
//----------------buffer overflows section code-------------
strcpy (name, argv[1]);
//-----------------buffer overflow section end-------------
system("PAUSE");
return EXIT_SUCCESS;
}
At address
0x00401010 this instruction resides:
cmp dword ptr [ebp+08],02 which I can tell is the
if ( argc < 2) part, then at the next address this instruction resides:
jnl 00401039, which is the jump to the 'main' part of the program, so I decided to redirect it directly to that address.
Even if I input the string that vinnu provided to redirect the execution back to ‘main’ function (address 0x0040107E), which is
AAAAAAAAAAAAAAAAAAAA~^P@ (^P is ctlr+P), it still crashes. Isn't that strange? I though that since xp doesn't have the aslr feature, an exploit code will work on every xp machine that runs that program...
Reply With Quote
Originally Posted by zazza
