The DMZ

9:13 AM

Question: If I overflow a variable then why ebp changes? Suppose buffer[64] is a variable and I overflow it with AAA.... and I know that previously ebp contains some address and was pointing to somewhere but now why ebp got changed to AAAAA?

I mean how contents of ebp got changed (which is just a address)? What I understand is by overflowing a variable the contents of subsequent memory locations will be changed but I don't understand how ebp itself got changed?

I had read concept of ebp and esp countless times

But I always got confused

Take another example: int a = 7; int ptr = &a;

Now If I am somehow able to change a then it's address will change obviously i.e., ptr will still contain that address.

But in above case similarly how ebp got changed?

This is the program

Stack after giving 85 A's as Input

  (gdb) i r
eax            0x29	41
ecx            0xb7fd84c0	-1208122176
edx            0xb7fd9340	-1208118464
ebx            0xb7fd7ff4	-1208123404
esp            0xbffff7bc	0xbffff7bc
ebp            0x41414141	0x41414141
esi            0x0	0
edi            0x0	0

*Now If I am somehow able to change a then it's address will not change obviously i.e., ptr will still contain that address.

I am banging my head for hours

Is anybody here?

@forest you here?

TL;DR In a stack based buffer overflow situation, why contents of ebp got changed if we overflow a variable?

10:11 AM

Good morning, my dear Hackerinos!

Morning

I find it absolutely hilarious how The Big Bang Theory is probably the most controversial topic discussed in the DMZ since I joined.

@JourneymanGeek No, work sucks and then you go home and paint miniatures, and then you die.

of lead poisoning?

Unless you are the guy who got ran over by a tram yesterday. Big oof.

@daya In gdb?

Yes

Fuck

I deleted whole message

Did you already read @MechMK1?

Or should I rewrite?

So the message was: Does anyone know gdb's info registers command outputs registers's content or where it is pointing?

10:42 AM

Sorry, I was away for a second

Let me look that up

From what I could see in the man, it's the content of the registers

I mean, it makes sense. Not everything in a register is a pointer

And gdb would have a hard time determining if 0xb7fd7ff4 is a pointer to a location in memory or just a very large value

> info registers
> Print the names and values of all registers except floating-point registers (in the selected stack frame).

1 hour later…

11:57 AM

I just realized my bank fucked up 2FA by just swapping username/password for username+one-time-key.

It's still 1FA, they just changed the factor.

12:45 PM

IE has been my browser since IE2(when I bought my win95). I never changed the browser. I am using IE11. I did try other browsers and also Edge. Never like them You can call me stupid, I don't mind. If SE or MS stops supporting IE, I guess I'll give it up. Until then, I'll continue to use IE. — scaaahu Jan 20 at 9:41

I don't know if I should respect that guy for sticking to his decision, or make fun of him for his terrible browser choice.

I guess we will have to wait for 10 years before IE becomes retro-cool and everybody will shit on whatever browser is popular then and say that they always liked IE and constantly used it.

@MechMK1 oh. I posted the question primarily to annoy someone who kept posting IE 11 bugs

@JourneymanGeek IE should literally burn in hell.

Not in a "Goodbye, old friend"-manner either. Literally burn in hell.

And I answered it to shut up the autobumper

There has never been anything good about IE. It was never a "good alternative" or anything.

It's fine for downloading a better browser 🤣

12:49 PM

The only time you had to use IE was when you freshly installed your OS and had to download your preferred browser, or if you were stuck with a shitty cooperate web application written by developers who probably accidentally lobotomized themselves with a pencil, which only works on Internet Explorer 7

Or getting chocolatey installed I guess

@MechMK1 done both till recently

@MechMK1 Sure, but as you can see above ebp contains 0x41414141 but how does it makes sense? I mean ebp is stack frame pointer so to access the value it is pointing I can use x/x $ebp which should output 0x41 but what is happening here is ebp is not pointing to the 0x4141414 but it is containing it that means it is saved as a address in ebp since it's a pointer which simply don't makes sense

@JourneymanGeek I'm sorry to hear that

@daya I really don't know. I don't use gdb that often, but feel free to ask that question on Stack Overflow or Super User.

@MechMK1 Oh okay, binary exploitation is really confusing

@daya I believe you. I'm sure some people here may know more about reversing here, but I think there also a reversing stack exchange

Let me see

Reverse Engineering

12:54 PM

Yes it is

I know that

Why not ask your question there?

Because it's not even a question

I mean it's just dumb

I think I am just tired mentally

I will try it tomorrow

Anonymous

1:15 PM

Spent the last few hours trying to get a Padding Oracle attack working on a .NET application - no dice.

Anonymous

I'm so annoyed. This vulnerability is so stupid.