10

I am trying to implement a buffer overflow attack and I need to know the address of my buffer that I am trying to overflow.

The address that is displayed using GDB is different than if I just did this in the code:

Exact code:

#include<stdio.h>

int main() {
   char buffer[20];
   printf("%p\n", buffer); // 0xbffff320

   return 0;
}

However, in gdb if I do:

p &buffer

I get: 0xbffff330

Why is there a difference and will it mess up my buffer overflow attack?

I have ALSR and stack guard disabled.

Thanks.

EDIT 1: Even when I step through gdb and it encounters the print line, I get 0xbffff320 as the address

EDIT 2:

Environment: Ubuntu Linux 9 image running in virtual box on windows 7.

The gdb version: 6.8-debian

Compiled using GCC such as: gcc -g -fno-stack-protector filename.c execute immediately: ./a.out address printed: 0xbffff320

Then open in debugger like this: gdb ./a.out then enter b main then run then p &buffer

Then address is 0xbffff330

Edit 3:

This is the gdb log to reproduce behavior:

$ gdb ./a.out

b main

run

p &buffer /* address here is different than what is shown if I run executable */

step through program to printf statement /* address here is same as p &buffer but different than what is printed when program is ran */

31
  • 1
    You mean, during the same run in gdb, printf and gdb's print output different values?
    – hdl
    Sep 24, 2015 at 22:08
  • Relying on undefined behaviour is quite a bad idea. Anyway, I do not think SO should help exploiting vulnerabilities. Sep 24, 2015 at 22:11
  • 2
    @Olaf, This is a project for a University. We are learning how to stack smash.
    – Kingamere
    Sep 24, 2015 at 22:13
  • 1
    @hdl, We are only allowed to compile disabling the stack guard. So the only flag we can provide is -fno-stack-protector. (In addition to optional ones like -g for debugging, -o for renaming executable etc.)
    – Kingamere
    Sep 24, 2015 at 22:16
  • 3
    OK. If p &buffer in gdb prints the same address as stepping past the printf statement in gdb, then this is consistent with gdb simply adding stuff to the environment, as @ouah's answer explains. There's another difference in play here, too: argv[0]. I've added an answer to address this. Sep 28, 2015 at 17:50

4 Answers 4

16

The question, as I understand it, is why the address of a local variable in main is different when the program is started from the shell versus when it is started from gdb.

Here's a sample program to show the difference:

mp@ubuntu:~$ cat s.c
#include<stdio.h>

int main(int argc, char **argv) {
  char buffer[20];
  system("env");
  printf("%s %p\n", argv[0], buffer);

  return 0;
}

We'll run it in a clean environment. (I also disabled ASLR).

mp@ubuntu:~$ env -i sh
$ ./s
PWD=/home/mp
./s 0xbffffe48

 

$ gdb ./s
(gdb) run
Starting program: /home/mp/s 
COLUMNS=80
PWD=/home/mp
LINES=42
/home/mp/s 0xbffffe08

The output from gdb's print &buffer command is the same as the program's idea of the address, but they're both different from when the program was run in the shell.

(gdb) b 6
Breakpoint 1 at 0x804849c: file s.c, line 6.
(gdb) run
Starting program: /home/mp/s 
COLUMNS=80
PWD=/home/mp
LINES=42

Breakpoint 1, main (argc=1, argv=0xbffffed4) at s.c:6
6      printf("%s %p\n", argv[0], buffer);
(gdb) p &buffer
$1 = (char (*)[20]) 0xbffffe08
(gdb) n
/home/mp/s 0xbffffe08
8      return 0;

There are a couple of things contributing to the difference:

  • gdb is invoking the program with an absolute pathname, so the argv array is bigger.
  • gdb sets (or in this case, adds) two environment variables. This is done in readline/shell.c:sh_set_lines_and_columns(). So the environ array is bigger.

To remove those two variables from the environment, you can use unset environment, or set exec-wrapper to run env -u .... That way, the program's addresses under gdb are the same as when it's run in the shell (if we use an absolute pathname).

$ `pwd`/s
PWD=/home/mp
/home/mp/s 0xbffffe28

$ gdb `pwd`/s
(gdb) set exec-wrapper env -u LINES -u COLUMNS
(gdb) run
Starting program: /home/mp/s 
PWD=/home/mp
/home/mp/s 0xbffffe28
3
  • Ahh I see, thanks. This was bugging me for a while. What are the environment variables, lines and columns?
    – Kingamere
    Sep 28, 2015 at 20:45
  • 1
    Yeah, the readline package that gdb uses sets them. They're the dimensions of your terminal window. I haven't looked into why it does that. It probably uses the values internally so it can properly display a command line that's so long that it takes more than one physical line of the terminal. Sep 28, 2015 at 20:55
  • Good to know. Thanks again
    – Kingamere
    Sep 29, 2015 at 16:45
1

Your array object in your system is stored in the stack. At the top of your stack there is, among other, the environment. When you run your program with gdb, gdb will provide a different environment (the env var and their value) which explains the addresses difference.

You can check the difference by running show environment in gdb and by comparing the output with set command in your shell.

17
  • Thanks, I'll look at this now.
    – Kingamere
    Sep 24, 2015 at 22:17
  • So you are saying gdb displays a different environment, and the values displayed by GDB is much more accurate and complete than if I just did printf through the code?
    – Kingamere
    Sep 24, 2015 at 22:19
  • You can try by yourself with your program. Run your program (without gdb) see the address. Then export BLA= with a long string and run your program again (still without gdb) you'll see the address is now different.
    – ouah
    Sep 24, 2015 at 22:26
  • @ouah but how could they be different when program is run in a single instance of gdb?
    – hdl
    Sep 24, 2015 at 22:31
  • 3
    If you are using gdb the status of ASLR can be different, you can disable it in gdb with set disable-randomization off.
    – ouah
    Sep 24, 2015 at 22:39
0

Found out that this is expected behavior in old versions of GDB (mine is 6.8-debian), and if you construct your buffer overflow attack properly you can work around this behavior and it won't be a problem.

2
  • Could you please share some reference(s)? How did you find out? :)
    – hdl
    Sep 24, 2015 at 23:58
  • My only reference is my professor telling me that gdb adds some instructions to the bottom of the stack so it can debug properly. My point is that in the context of performing a buffer overflow attack, this address disparity shouldn't affect the attack too much, and you can still manage to do it.
    – Kingamere
    Sep 25, 2015 at 0:04
0

For the moment, the only reasons I can imagine are :

  • you tried to print &buffer after your program terminated. Solution: try setting a breakpoint on main, run, next to execute printf, and print &buffer.
  • you first ran your program outside gdb, then ran it inside gdb but forgot to execute the printf line with next.
  • a bug in your version of gdb
  • a bug in your version of gcc (gcc might produce incorrect debug info: see 1 and 2)
7
  • Yes I did: "b main" and then "run", and then immediately did "p &buffer"
    – Kingamere
    Sep 24, 2015 at 22:26
  • @Ikshvaku then did you execute the printfinstruction with next? (see updated answer)
    – hdl
    Sep 24, 2015 at 23:28
  • Yes I did that. Also my professor just responded and said that GDB adds some stuff to the bottom of the stack to help it debug properly. But that still doesn't explain why you don't see different addresses.
    – Kingamere
    Sep 24, 2015 at 23:34
  • Actually it could just be that my version of GDB is a lot older (6.8). What is your GDB version?
    – Kingamere
    Sep 24, 2015 at 23:34
  • 1
    The addresses are still different this time. I was actually able to solve my buffer overflow problem despite this disparity in addresses. It is very minor and won't affect the attack much. I believe, as my professor said, it's just GDB that is giving this behavior. Therefore, I'll mark the question as answered.
    – Kingamere
    Sep 24, 2015 at 23:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.