Exploit Development: Getting Started

What it is

A beginner walkthrough of how a stack frame is built for main, using GDB on 32-bit Ubuntu 14. The page gives a repeatable GDB procedure for watching the frame form one instruction at a time. The article is by AirCorridor, a Hackers-Arise contributor.

How it works

The test program is a C main(int argc, char *argv[]) with int a = 15, int b = 23 and char *mystr = "Hello". The string literal sits in the read-only data segment, and only the pointer lives on the stack.

The page steps through the prologue in GDB:

1. push ebp puts the base pointer on the stack.
2. ESP is moved to the same location as EBP.
3. sub esp, 0x10 reserves 16 bytes, which is four 4-byte words.
4. mov instructions then overwrite the placeholder words with 0xf (15), 0x17 (23) and the mystr pointer. The page says b lands 8 bytes from EBP.

The page labels the surrounding words as null values, the return address, argc (1 when only the program name is given) and argv (unused here).

What to do

Commands the page uses, in order:

kali> gcc -g filename.c -o executableName
kali> sudo apt install gdb
kali> gdb executableName
(gdb) disass main
(gdb) display/12wx $esp
(gdb) display/2i $eip
(gdb) b * 0x080483ee
(gdb) run
(gdb) ni
(gdb) p 0xf

After the breakpoint hits, print ESP and EBP. EBP reads 0x0 before the push. Step with ni, then print ESP minus EBP to confirm the 16-byte gap.

Caveats

• The breakpoint address 0x080483ee comes from the author's binary. Take the address of the instruction after the prologue from your own disass main output.
• The screenshots carry much of the output, so the fetched text omits the disassembly and register values.
• The page prompts with kali> but says the demo runs on 32-bit Ubuntu 14. It does not say whether the binary was built with -m32 or with any stack protections disabled.
• The article stops at stack layout. It has no overflow, return-address overwrite or ROP, though it names them as later topics in the series.