title: GDB: Change string in memory on stack
body: <p>I'm attempting to make my way through a Capture-the-Flag live VM, and getting stuck when trying to use gdb to alter a value passed on the stack (last item to be pushed):</p>
  
  <pre><code>system("date");
  </code></pre>
  
  <p>To</p>
  
  <pre><code>system("ash");
  </code></pre>
  
  <p>So far, my gdb efforts have been as follows:</p>
  
  <p><strong>stack</strong></p>
  
  <p>The address I'm interested in is the last item on the stack (first in the stack list below)</p>
  
  <pre><code>(gdb) p $esp
  $1 = (void *) 0xbf902690
  
  (gdb) x/32w 0xbf902690
  0xbf902690: 0x080485ff  0x0000044c  0xb7783ff4  0xbf9026b8
  0xbf9026a0: 0xb76a8fa9  0xb7797356  0x08048529  0x0000044c
  0xbf9026b0: 0x08048520  0x08048410  0xbf902728  0xb7695cf7
  0xbf9026c0: 0x00000001  0xbf902754  0xbf90275c  0xbf9026e4
  ....
  (gdb) x/s 0x080485ff
  0x80485ff:   "date"
  (gdb) x/s *0x080485ff
  0x65746164:  &lt;Address 0x65746164 out of bounds&gt;
  (gdb)
  </code></pre>
  
  <p><strong>Attempt to change memory 1</strong></p>
  
  <pre><code>(gdb) set {const char [4] *}0x080485ff = "ash "
  (gdb) x/s 0x080485ff
  0x80485ff:   "\b`\354\b"
  (gdb)
  </code></pre>
  
  <p>As you can see, I mangle the pointer.</p>
  
  <p><strong>Attempt to change memory 2</strong></p>
  
  <pre><code>(gdb) set *((const char *)0x080485ff) = "ash "
  (gdb) x/s 0x080485ff
  0x80485ff:   "\bate"
  (gdb)
  </code></pre>
  
  <p>More mangling - something to do with wrongly dereferencing?</p>
  
  <p><strong>Attempt to change memory 3</strong></p>
  
  <pre><code>(gdb) set {int}0x080485ff = 68736100
  (gdb) x/s 0x080485ff
  0x80485ff:   "d\324\030\004"
  (gdb)
  </code></pre>
  
  <p>Trying to use the ASCII values instead - doesn't work out as planned.</p>
  
  <p>Any help appreciated - been scratching my (bald) head for a while now...</p>
  
  <p>Thanks</p>
  
  <p>sc.</p>