Using Unique Patterns to Find the EIP Offset in a 32-Bit Buffer Overflow
· 9:48 · Watch on YouTube ↗
Summary
A tutorial demonstrates using a pattern.py script to fuzz a 32-bit program, identify an access violation, find the EIP overwrite offset, and verify the 740-byte offset against the stack layout in IDA.
Key points
- The demonstrated pattern.py script creates unique patterns for locating where input reaches EIP in a 32-bit process; it is not compatible with 64-bit processes.
- The example program reads a file into a local buffer, allowing input length to be varied to test for a crash.
- The tutorial explains that fuzzing involves generating and delivering input while monitoring the program, here manually under a debugger.
- After a 750-byte input causes an access violation, the value in EIP is supplied to the script's offset mode.
- The script reports an overwrite offset of 740 bytes, which the video verifies by adding the buffer and intervening stack values in IDA.
Article Details
- Topics
- [00:03] Buffer-overflow and fuzzing concepts, including the 32-bit limitation
- [01:10] Example program that reads input from a file into a local buffer
- [01:38] Creating unique patterns and using the script's create and offset modes
- [04:57] Delivering test input and monitoring the program under a debugger
- [06:32] Finding the EIP value after a crash and calculating the overwrite offset
- [08:02] Verifying the 740-byte offset against the stack layout in IDA