Vortex 1 will soon be mine
I am reading the resources that go along with the vortex 1 wargame from pulltheplug.org. For fun, I modified one of their simple buffer overflow examples from 32 to 64 bit. Here’s the code.
void function(int a, int b, int c) {
char buffer1[5];
char buffer2[10];
int *ret;
ret = buffer1 + 24;
(*ret) += 7;
}
void main() {
int x;
x = 1;
function(1,2,3);
x = 0;
printf(“%d\n”,x);
}
The hard part was finding out what to add to the buffer1 address to point to the function’s return address. Buffer1 takes 8 bytes wich makes sence on a 64 bit system. What doesn’t make sense is that there is still 16bytes. I don’t think that it is all occupied by the frame pointer, but that’s all the resources mention.
The number 7 is added because adding 7 bytes moved the IP to the printf line. In my testing the x=0 line was at 0×00000000004004f5 and the printf was at 0×00000000004004fc. A difference of 7 bytes.
Tags: Tech