5 printf("%s\n", "Execution Hijacked"); 6 } 7 8 void function(char *str) { 9 char buffer[5]; 10 strcpy(buffer,str); 11 } 12 void main(int argc, char *argv[]) 13 { 14 function(argv[1]); 1 #include 2 #include 3 4 void overflowed() { 5 printf("%s\n", "Execution Hijacked"); 6 } 7 8 void function(char *str) { 9 char buffer[5]; 10 strcpy(buffer,str); 11 } 12 void main(int argc, char *argv[]) 13 { 14 function(argv[1]); 15 printf("%s\n","Executed normally"); 16 } Breakpoint 1 at 0x804844b: file overflowtest.c, line 14. Breakpoint 2 at 0x804842e: file overflowtest.c, line 10. Breakpoint 3 at 0x8048440: file overflowtest.c, line 11. Num Type Disp Enb Address What 1 breakpoint keep y 0x0804844b in main at overflowtest.c:14 2 breakpoint keep y 0x0804842e in function at overflowtest.c:10 3 breakpoint keep y 0x08048440 in function at overflowtest.c:11 Starting program: /home/lstudent/lab/overflowtest AAAA Breakpoint 1, main (argc=2, argv=0xbffff4c4) at overflowtest.c:14 14 function(argv[1]); 0xbffff400: 0x0016d4a5 0x0011e030 0x0804848b 0x00293ff4 0xbffff410: 0x08048480 0x00000000 0xbffff498 0x00154bd6 0xbffff420: 0x00000002 0xbffff4c4 0xbffff4d0 0x0012f858 0xbffff430: 0xbffff480 0xffffffff 0x0012bff4 0x0804826d 0xbffff418: 0xbffff498 Currently logging to "gdb.txt". Logs will be appended to the log file. Output will be logged and displayed. Currently logging to "gdb.txt". Logs will be appended to the log file. Output will be logged and displayed. Continuing. Breakpoint 2, function (str=0xbffff65c "AAAA") at overflowtest.c:10 10 strcpy(buffer,str); 0xbffff3d0: 0x00293ff4 0x08049ff4 0xbffff3e8 0x0804830c 0xbffff3e0: 0x0011e030 0x08049ff4 0xbffff418 0x08048499 0xbffff3f0: 0x00294324 0x00293ff4 0xbffff418 0x0804845b 0xbffff400: 0xbffff65c 0x0011e030 0x0804848b 0x00293ff4 0xbffff3f8: 0xbffff418 Dump of assembler code for function main: 0x08048442 <+0>: push %ebp 0x08048443 <+1>: mov %esp,%ebp 0x08048445 <+3>: and $0xfffffff0,%esp 0x08048448 <+6>: sub $0x10,%esp 0x0804844b <+9>: mov 0xc(%ebp),%eax 0x0804844e <+12>: add $0x4,%eax 0x08048451 <+15>: mov (%eax),%eax 0x08048453 <+17>: mov %eax,(%esp) 0x08048456 <+20>: call 0x8048428 0x0804845b <+25>: movl $0x8048543,(%esp) 0x08048462 <+32>: call 0x8048350 0x08048467 <+37>: leave 0x08048468 <+38>: ret End of assembler dump. Continuing. Breakpoint 3, function (str=0xbffff65c "AAAA") at overflowtest.c:11 11 } 0xbffff3d0: 0xbffff3eb 0xbffff65c 0xbffff3e8 0x0804830c 0xbffff3e0: 0x0011e030 0x08049ff4 0x41fff418 0x00414141 0xbffff3f0: 0x00294324 0x00293ff4 0xbffff418 0x0804845b 0xbffff400: 0xbffff65c 0x0011e030 0x0804848b 0x00293ff4 0xbffff3f8: 0xbffff418