Search code examples
cgdbfedoracpu-registersbuffer-overflow

Buffer Overflow Test on Fedora 32-bit not changing $eip register value


I am trying to perform a simple buffer overflow on 32-bit Fedora, but the eip register value is not changing

My C code is as follows :

#include <string.h>
int main(int argc, char ** argv){
    char buffer[8];
    strcpy(buffer, argv[1]);
}

I have tried executing :

echo 0 > /proc/sys/kernel/exec-shield
echo 0 > /proc/sys/kernel/randomize_va_space

to disable any kind of protection. As well as I have compiled like this:

gcc -g -Wall -fno-stack-protector -z execstack -m32 boftest.c -o boftest

When I run the command

./boftest AAAABBBBCCCCDDDD

And then observe the register values using gdb; I see that:

ebp contains  0x44444444, but 
eip contains 0x80483F4

which means $eip hasn't been successfully modified.

I have read other questions with the same problem, but none of the solutions worked for me. Would you have any idea how to make this work?


Solution

  • Okay I think I figured out what was going wrong eventually. I was trying the buffer overflow test on Linux's Fedore 9. I tried all the modifications but nothing worked.

    So i changed the OS to Ubuntu 12.04 and the test worked perfectly. By executing ./boftest `perl -e 'print "A" x 200'` , the $eip register value was overwritten to 0x41414141 where 0x41 is the hexadecimal value of 'A' caracter, which means that the buffer overflow test worked.

    I think that the problem was with the Fedora OS, maybe it offered other levels of protection against buffer overflow that I wasn't aware of, while the ubuntu 12.04 version didn't. I only needed the command echo 0 > /proc/sys/kernel/randomize_va_space for the test to work.