練習時為參考此網頁
https://www.geeksforgeeks.org/buffer-overflow-attack-with-example/

一題基本的buffer overflow題目
我試著跟著實作練習
程式碼如下

// A C program to demonstrate buffer overflow 
#include <stdio.h> 
#include <string.h> 
#include <stdlib.h> 
  
int main(int argc, char *argv[]) 
{ 
  
       // Reserve 5 byte of buffer plus the terminating NULL. 
       // should allocate 8 bytes = 2 double words, 
       // To overflow, need more than 8 bytes... 
       char buffer[5];  // If more than 8 characters input 
                        // by user, there will be access  
                        // violation, segmentation fault 
  
       // a prompt how to execute the program... 
       if (argc < 2) 
       { 
              printf("strcpy() NOT executed....\n"); 
              printf("Syntax: %s <characters>\n", argv[0]); 
              exit(0); 
       } 
  
       // copy the user input to mybuffer, without any 
       // bound checking a secure version is srtcpy_s() 
       strcpy(buffer, argv[1]); 
       printf("buffer content= %s\n", buffer); 
  
       // you may want to try strcpy_s() 
       printf("strcpy() executed...\n"); 
  
       return 0; 
} 

練習環境

#uname -a
Linux hackercat 5.2.0-kali2-amd64 #1 SMP Debian 5.2.9-2kali1 (2019-08-22) x86_64 GNU/Linux

遇到了幾個問題
1.第一個
反覆看了網頁中的註解
還是不懂為什麼buffer[5]之後
超過8個bytes才會overflow
跟終止字串又有甚麼關係

2.第二個
實作過程中我用了完全一樣的code
利用32-bits跟64-bits都進行編譯過
不過兩個執行檔 都不是在9 bytes時發生overflow

首先用32-bit compile的檔案, 他會在第17 bytes發生

root@hackercat:~/program# file bufferOverflow0
bufferOverflow0: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, BuildID[sha1]=8f77562224f202160a6774db11433e2611400907, for GNU/Linux 3.2.0, not stripped
root@hackercat:~/program# ./bufferOverflow0 11111111111234567
buffer content= 11111111111234567
strcpy() executed...
Segmentation fault
root@hackercat:~/program# ./bufferOverflow0 1111111111123456
buffer content= 1111111111123456
strcpy() executed...

再來是用64-bit compile的檔案, 他會在第13 bytes發生

root@hackercat:~/program# file bufferOverflow064 
bufferOverflow064: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=7e6e3baa75e1b2d4edf683f6a073bf961b888575, for GNU/Linux 3.2.0, not stripped
root@hackercat:~/program# ./bufferOverflow064 111111111112
buffer content= 111111111112
strcpy() executed...
root@hackercat:~/program# ./bufferOverflow064 1111111111123
buffer content= 1111111111123
strcpy() executed...
Segmentation fault