bufbomb 

(gdb) disas
Dump of assembler code for function getbuf:
   0x0000000000400da0 <+0>:    push   %rbp
   0x0000000000400da1 <+1>:    mov    %rsp,%rbp
   0x0000000000400da4 <+4>:    sub    $0x30,%rsp
   0x0000000000400da8 <+8>:    lea    -0x30(%rbp),%rdi
=> 0x0000000000400dac <+12>:    callq  0x400cb0 <Gets>
   0x0000000000400db1 <+17>:    movabs $0xcccccccccccccccd,%rdx
   0x0000000000400dbb <+27>:    mov    %rax,%rcx
   0x0000000000400dbe <+30>:    mul    %rdx
   0x0000000000400dc1 <+33>:    shr    $0x5,%rdx
   0x0000000000400dc5 <+37>:    lea    (%rdx,%rdx,4),%rax
   0x0000000000400dc9 <+41>:    mov    %rcx,%rdx
   0x0000000000400dcc <+44>:    shl    $0x3,%rax
   0x0000000000400dd0 <+48>:    sub    %rax,%rdx
   0x0000000000400dd3 <+51>:    mov    $0x24,%eax
   0x0000000000400dd8 <+56>:    cmp    $0x24,%rdx
   0x0000000000400ddc <+60>:    cmovae %rdx,%rax
   0x0000000000400de0 <+64>:    xor    %ecx,%ecx
   0x0000000000400de2 <+66>:    add    $0x1e,%rax
   0x0000000000400de6 <+70>:    and    $0xfffffffffffffff0,%rax
   0x0000000000400dea <+74>:    sub    %rax,%rsp
   0x0000000000400ded <+77>:    lea    0xf(%rsp),%r8
   0x0000000000400df2 <+82>:    and    $0xfffffffffffffff0,%r8
   0x0000000000400df6 <+86>:    nopw   %cs:0x0(%rax,%rax,1)
   0x0000000000400e00 <+96>:    movzbl -0x30(%rbp,%rcx,1),%edi
   0x0000000000400e05 <+101>:    lea    (%r8,%rcx,1),%rsi
   0x0000000000400e09 <+105>:    add    $0x1,%rcx
   0x0000000000400e0d <+109>:    cmp    $0x24,%rcx
   0x0000000000400e11 <+113>:    mov    %dil,(%rsi)
   0x0000000000400e14 <+116>:    jne    0x400e00 <getbuf+96>
   0x0000000000400e16 <+118>:    mov    %rdx,%rax
   0x0000000000400e19 <+121>:    leaveq 
---Type <return> to continue, or q <return> to quit---
   0x0000000000400e1a <+122>:    retq   
End of assembler dump.
(gdb) i f
Stack level 0, frame at 0x7fffffffb3e0:
 rip = 0x400dac in getbuf (bufbomb.c:136); saved rip 0x400ef3
 called by frame at 0x7fffffffb410
 source language c.
 Arglist at 0x7fffffffb3d0, args: 
 Locals at 0x7fffffffb3d0, Previous frame's sp is 0x7fffffffb3e0
 Saved registers:
  rbp at 0x7fffffffb3d0, rip at 0x7fffffffb3d8
(gdb) i r
rax            0x0    0
rbx            0x47982bd9    1201155033
rcx            0xdeadbeef    3735928559
rdx            0x7ffff7dd8e10    140737351880208
rsi            0x401344    4199236
rdi            0x7fffffffb3a0    140737488335776
rbp            0x7fffffffb3d0    0x7fffffffb3d0
rsp            0x7fffffffb3a0    0x7fffffffb3a0
r8             0x7ffff7ff700d    140737354100749
r9             0xc0000    786432
r10            0x0    0
r11            0x7ffff7ad6d32    140737348726066
r12            0x607f80    6324096
r13            0x7fffffffe360    140737488348000
r14            0x0    0
r15            0x0    0
rip            0x400dac    0x400dac <getbuf+12>
eflags         0x206    [ PF IF ]
cs             0x33    51
ss             0x2b    43
ds             0x0    0
es             0x0    0
fs             0x0    0
gs             0x0    0
(gdb) x /64x 0x7fffffffb3a0
0x7fffffffb3a0:    0xffffe260    0x00007fff    0x00607f80    0x00000000
0x7fffffffb3b0:    0xffffe360    0x00007fff    0xf7df0a55    0x00007fff
0x7fffffffb3c0:    0x00002e10    0x00000000    0xf7afe947    0x00007fff
0x7fffffffb3d0:    0xffffb400    0x00007fff    0x00400ef3    0x00000000
0x7fffffffb3e0:    0xffffb410    0x00007fff    0xdeadbeef    0x00000000
0x7fffffffb3f0:    0xf7dd70e0    0x00007fff    0x47982bd9    0x00000000
0x7fffffffb400:    0xffffe260    0x00007fff    0x00400fdd    0x00000000
0x7fffffffb410:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb420:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb430:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb440:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb450:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb460:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb470:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb480:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb490:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4

(gdb) x /64x 0x7fffffffb3a0
0x7fffffffb3a0:    0xaaaaaaaa    0xaaaaaaaa    0xaaaaaaaa    0xaaaaaaaa
0x7fffffffb3b0:    0xaaaaaaaa    0xaaaaaaaa    0xaaaaaaaa    0xaaaaaaaa
0x7fffffffb3c0:    0xaaaaaaaa    0xaaaaaaaa    0xaaaaaaaa    0xaaaaaaaa
0x7fffffffb3d0:    0xaaaaaaaa    0xaaaaaaaa    0xc0010400    0x00000000
0x7fffffffb3e0:    0xffffb410    0x00007fff    0xdeadbeef    0x00000000
0x7fffffffb3f0:    0xf7dd70e0    0x00007fff    0x47982bd9    0x00000000
0x7fffffffb400:    0xffffe260    0x00007fff    0x00400fdd    0x00000000
0x7fffffffb410:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb420:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb430:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb440:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb450:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb460:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb470:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb480:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb490:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4



 

 1 (gdb) c
 2 Continuing.
 3 Type string: Misfire: You called fizz(0xdeadbe00)
 4 [Inferior 1 (process 27846) exited normally]
 5 
 6 (gdb) x /24x 0x7fffffffb3d0 
 7 0x7fffffffb3d0:    0xaaaaaaaa    0xaaaaaaaa    0x00401070    0x00000000
 8 0x7fffffffb3e0:    0xaaaaaaaa    0xaaaaaaaa    0xdeadbe00    0x00000000
 9 0x7fffffffb3f0:    0xf7dd70e0    0x00007fff    0x47982bd9    0x00000000
10 0x7fffffffb400:    0xffffe260    0x00007fff    0x00400fdd    0x00000000
11 0x7fffffffb410:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
12 0x7fffffffb420:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4

 

(gdb) c
Continuing.
Type string: Misfire: global_value = 0x0
[Inferior 1 (process 28731) exited normally]
(gdb) i f
Stack level 0, frame at 0x7fffffffb3e0:
 rip = 0x400dac in getbuf (bufbomb.c:136); saved rip 0x400ef3
 called by frame at 0x7fffffffb410
 source language c.
 Arglist at 0x7fffffffb3d0, args: 
 Locals at 0x7fffffffb3d0, Previous frame's sp is 0x7fffffffb3e0
 Saved registers:
  rbp at 0x7fffffffb3d0, rip at 0x7fffffffb3d8
(gdb) x /64x 0x7fffffffb3d0
0x7fffffffb3d0:    0xffffb400    0x00007fff    0x00400ef3    0x00000000
0x7fffffffb3e0:    0xffffb410    0x00007fff    0xdeadbeef    0x00000000
0x7fffffffb3f0:    0xf7dd70e0    0x00007fff    0x47982bd9    0x00000000
0x7fffffffb400:    0xffffe260    0x00007fff    0x00400fdd    0x00000000
0x7fffffffb410:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb420:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb430:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb440:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb450:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb460:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb470:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb480:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb490:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb4a0:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb4b0:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4
0x7fffffffb4c0:    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4    0xf4f4f4f4

 

posted @ 2014-08-09 21:13  been  阅读(547)  评论(0)    收藏  举报