I'm new to buffer overflows and although I believe I get the process, I feel that something is wrong here. I am studying from a book about exploitation and in the example, there is a simple buffer overflow on a 16 bytes string. This is the code of the binary.
#include <stdio.h>
#include <string.h>
void vuln(){
char buff[16];
scanf("%s",buff);
printf("You entered: %s",buff);
}
void secret(){
printf("My secret is 131313");
}
int main() {
vuln();
return 0;
}
As you can guess, the goal is to call the secret function. I compile it on my Mac using Clang with the following arguments -arch armv7
-fno-stack-protector
-fno-pie
, so no protection and ARMv7 architecture. It runs normally on the iPhone and when it asks for user input I enter 32 bytes, in groups of four like this AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHH
. When the application crashes I check on iOS logs and I can see that the crashing happens where the F
s start from.
What I expected to see, is that the pc
register will have value 0x46464646
for F, but actually it returns 0x46464644
.
These are the values of the registers at the time of crash.
Thread 0 Crashed:
0 ??? 0x46464644 0 + 1179010628
Thread 0 crashed with ARM Thread State (32-bit):
r0: 0x0000002d r1: 0x00000000 r2: 0x3ba30f80 r3: 0x00000000
r4: 0x00000000 r5: 0x0000bf71 r6: 0x00000000 r7: 0x45454545
r8: 0x00201854 r9: 0x00000000 r10: 0x00000000 r11: 0x00000000
ip: 0x00012068 sp: 0x00201834 lr: 0x0000bf53 pc: 0x46464644
cpsr: 0x40000010
Also, I tried with just 40 A
s and it returned 0x41414140
. Why it does not return the input entered as expected?
Thank you
In case anyone has the same issue as me, I found out that r15 or pc should always be divided by 4 in ARM. From the official ARM Documentation:
Note that r15 cannot be used with writeback, and that offset must be divisible by 4
User contributions licensed under CC BY-SA 3.0