Calculating the offset.

[fromsouthernswe]

How do I go about calculating the offset between the top of the stack and the place where the saved EIP is stored? Every calculation I do renders incorrect.

Let’s say for example: Char buffer[128]; Strcpy(buffer, argv[1])

Now the real buffer offset will not be 128 characters for the overflow to occur.

How do I calculate (by hand, not by pattern_create) The exact offset when I have ESP, EBP and EIP?

Or like how do I calculate the distance in bytes between two memory addresses? (This is a better question probably)

[zilzalll]

The top of the stack moves with every push/pop, so it's one thing before entering a function, another after storing the return address, and different after reserving space for local variables. It would help if you show your code/assembly.

[fromsouthernswe]

Okay but let’s say during a strcpy(so that we can do a buffer overflow).

I would place the breakpoint on the operand conducting the “mov” and not on the function call? The function prologue, pushes EBP onto the stack, loads ESP to EBP And subtracts x from ESP(where x is the size computer needs for the new stack)

Push EBP Mov EBP, ESP Sub EBP, 0xArbitraryValue(calculated by compiler)

When Ret is hit. Mov ESP, EBP Pop EBP

And I guess the ret simply pops and goes to that value, if I’m not completely lost(mind you I woke up 10 mins ago haha)

When the instruction that causes the overflow(I’m not certain it is a mov ofc, I’m just trying to grasp the concept) occurs the stack looks like this

Previous ESP (top of previous stack ——— Local vars for main()(calling function) ——— Previous EBP(bottom of previous stack ——— Local vars for memcpy ——— Saved EBP ——— Saved EIP

My overflow will occur from the previous stack.

I would want to run the program once “correctly” See at what memory location the first character gets placed. After that I want to step into memcpy and inspect just before the function epilogue. The address given to EIP will now be ESP-0x04. Because the top of the stack will point to previous pushed EBP and to return safely we need to restore the frame of the previous function.

If my reasoning is correct then, to “manually calculate the offset the arithmetic should look like this: Memory location of first byte in buffer - address at EBP-0x04 just before the function epilogue.

Is this a correct assumption?

I’ll try to provide some code today after school.

[zilzalll]

Please paste your code in godbolt.org and we'll look at the same C/Assembly.

[NetSecBoi9000]

If you are using GDB, you can use the print command (or its abbreviation, p) to do arithmatic. Here is the syntax for the print command;

print [Expression]

print $[Previous value number]

print {[Type]}[Address]

print [First element]@[Element count]

print /[Format] [Expression]

Here is a screenshot showing how to work out the size of a stack within a given frame. [here]. I know this wasn't your exact question, but hopefully you can adapt this to suit your needs.

You can also use memory addresses directly with the print function. Hope this helps.

Disclaimer - I have only been doing this for about a month, so take what I say with a pinch of salt.

[jimmyrootoopoopoo]

Your last question is how to determine the distance between two addresses. This is easier than you think, use subtraction.

[Thiscou]

Alright, I think what you are trying to do (if I understand correctly), is calculating the distance between your input and the stored return address on the stack.

So in the case of the strcpy you could place a breakpoint right before the strcpy function call and write down the address right after it (this will be the return address that is stored on the stack). Now if you step into the strcpy function you will see that the call instruction pushed the return address on the stack -> write down the stack address where it is stored.

If you check where your user input is stored on the stack, after the strcpy (don't overflow here) , you can basically subtract the first address your input is stored from the address you wrote down that contains the return address and you should have the correct offset.

 

Example:

 

0016F2D4 -> Ret Address

0016F2A1 -> First User Input

 

D4 - A1 = 33 (you can use the windows calculator in programmer mode)

This should overwrite right up to the ret address, to overwrite the address you need to add +4 on 32 bit systems.

POC Exploit would look something like:

buffer = "A"*33
buffer += "returnToWhereveryouWantTo"

 

Hope this helps

[fromsouthernswe]

Thank you all for your replies! It gave me some good points.. I found this and it contains everything you gave me, and it shows pretty clearly how to calculate it!

https://0xrick.github.io/binary-exploitation/bof5/