buffer overflow problem

Question

After I reference this website, I want to simulate a simple buffer overflow bug
My environment is ubuntu 10.10
gcc version is 4.4.5
I also download the execstack to enable the executable stack of my file.
the following is my code

char code[] = "\x90\x90\x90\x6a\x00\xe8\x39\x07\x00\x00\x90\x90\x90";<
char msg[] = "run !!\n";
int main()
{     
     int *ptr;     
     int i;  
     for(i=1;i<128;i++){     
          ptr = (int *)&ptr + i;
          (*ptr) = (int)code;   
     }    

     return 0;
}

I use gcc -fno-stack-protector -g -static -o main.out main.c to compile my source code.
However when I use gdb to debug this executable file,
something weird happened.
here is the gdb output looks like:

(gdb) x/i 0x8048492
   0x8048492 <__libc_start_main+402>:   call   0x8048bd0 <exit>
(gdb) x/5b 0x8048492
0x8048492 <__libc_start_main+402>:  0xe8    0x39    0x07    0x00    0x00
(gdb) x/i 0x80ce02e
   0x80ce02e <code+6>:  call   0x80ce76c <_dlfcn_hooks+44>
(gdb) x/5b 0x80ce02e
0x80ce02e <code+6>: 0xe8    0x39    0x07    0x00    0x00

It seems like the the pattern of these two address are the same, but the instructions are different.
can somebody help me and explain why this happen.
thanks a lot!

But if the five raw bytes is the same, why the instruction is different. one is "call 0x8048bd0" and another is "call 0x80ce76c" but the raw bytes is \xe8\x39\x07\x00\x00 — mike820324

Bo Persson Bo Persson · Accepted Answer · 2011-05-01T18:56:57

You have a buffer overflow for sure, but this line

 (*ptr) = (int)code;

stores the address of code in each location, not the content of the code array.

buffer overflow problem

1 Answers