0

I just got started with buffer overflows and when I look for tutorials everyone has printf@plt and gets@plt in their assembler code, but I don't see them. Am I doing something wrong?

Source code:

#include <stdio.h>
#include <string.h>

int main()
{
char password[16];
int passcheck = 0;
void secret();

printf("\nWhat's the password?\n");
gets(password);

if (strcmp(password, "password1"))
{
    printf("\nYou fail/n");
}
else
{
    printf("\nCorrect password\n");
    passcheck = 1;
}

if(passcheck)
{
    secret();
}
return 0;
}

void secret()
{
printf("\nYou got it!!!\n");
}

assembler code:

0x00001e50 <+0>:    push   %ebp
0x00001e51 <+1>:    mov    %esp,%ebp
0x00001e53 <+3>:    push   %edi
0x00001e54 <+4>:    push   %esi
0x00001e55 <+5>:    sub    $0x40,%esp
0x00001e58 <+8>:    call   0x1e5d <main+13>
0x00001e5d <+13>:   pop    %eax
0x00001e5e <+14>:   lea    0x101(%eax),%ecx
0x00001e64 <+20>:   movl   $0x0,-0xc(%ebp)
0x00001e6b <+27>:   movl   $0x0,-0x20(%ebp)
0x00001e72 <+34>:   mov    %ecx,(%esp)
0x00001e75 <+37>:   mov    %eax,-0x24(%ebp)
0x00001e78 <+40>:   call   0x1f28
0x00001e7d <+45>:   lea    -0x1c(%ebp),%ecx
0x00001e80 <+48>:   mov    %ecx,(%esp)
0x00001e83 <+51>:   mov    %eax,-0x28(%ebp)
0x00001e86 <+54>:   call   0x1f22
0x00001e8b <+59>:   lea    -0x1c(%ebp),%ecx
0x00001e8e <+62>:   mov    -0x24(%ebp),%edx
0x00001e91 <+65>:   lea    0x118(%edx),%esi
0x00001e97 <+71>:   mov    %esp,%edi
0x00001e99 <+73>:   mov    %esi,0x4(%edi)
0x00001e9c <+76>:   mov    %ecx,(%edi)
0x00001e9e <+78>:   mov    %eax,-0x2c(%ebp)
0x00001ea1 <+81>:   call   0x1f2e
0x00001ea6 <+86>:   cmp    $0x0,%eax
0x00001ea9 <+89>:   je     0x1ec8 <main+120>
0x00001eaf <+95>:   mov    -0x24(%ebp),%eax
0x00001eb2 <+98>:   lea    0x122(%eax),%ecx
0x00001eb8 <+104>:  mov    %ecx,(%esp)
0x00001ebb <+107>:  call   0x1f28
0x00001ec0 <+112>:  mov    %eax,-0x30(%ebp)
0x00001ec3 <+115>:  jmp    0x1ee3 <main+147>
0x00001ec8 <+120>:  mov    -0x24(%ebp),%eax
0x00001ecb <+123>:  lea    0x12e(%eax),%ecx
0x00001ed1 <+129>:  mov    %ecx,(%esp)
0x00001ed4 <+132>:  call   0x1f28
0x00001ed9 <+137>:  movl   $0x1,-0x20(%ebp)
0x00001ee0 <+144>:  mov    %eax,-0x34(%ebp)
0x00001ee3 <+147>:  cmpl   $0x0,-0x20(%ebp)
0x00001ee7 <+151>:  je     0x1ef2 <main+162>
0x00001eed <+157>:  call   0x1f00 <secret>
0x00001ef2 <+162>:  xor    %eax,%eax
0x00001ef4 <+164>:  add    $0x40,%esp
0x00001ef7 <+167>:  pop    %esi
0x00001ef8 <+168>:  pop    %edi
0x00001ef9 <+169>:  pop    %ebp
0x00001efa <+170>:  ret    
0x00001efb <+171>:  nopl   0x0(%eax,%eax,1)
Tristan Diependael
  • 583
  • 6
  • 21

1 Answers1

3

Add debug symbols to your binaries by compiling your C program with appropriate switch for your C compiler. For example if you use gcc, use -g switch as is described here:. After that you will be able to see original C symbols names when executing your binary under gdb

Regarding your comment - maybe your object files weren't recompiled from scratch. Try to make clean if you use makefiles or just delete all the object (.o) files and then recompile your program with -ggdb switch (it is the same as -g switch but generates debug info specifically for gdb). After recompiling look in your binary for debug infor - couple of strings like 'printf@plt' and 'gets@plt'.

SergeyLebedev
  • 3,673
  • 15
  • 29
  • It still doesn't show them. I did this: gcc -g -fno-stack-protector -m32 -D_FORTIFY_SOURCE=0 -o a /Users/Tridie2000/Documents/Programmeer-projecten/CotEditor/simple.c followed by gdb a and disas main – Tristan Diependael Jan 18 '17 at 18:08
  • 1
    Maybe your object files weren't recompiled from scratch. Try to `make clean` if you use makefiles or just delete all the object (.o) files and then recompile your program with `-ggdb` switch (it is the same as `-g` switch but generates debug info specifically for `gdb`) – SergeyLebedev Jan 18 '17 at 21:07
  • BTW: some printf-s do get replaced by puts, even with optimization off. – dbrank0 Jan 19 '17 at 07:53