title: Why didn't printf print out the string in this buffer overflow?
body: <p>I'm learning buffer overflow. I wrote a small C program: </p>
  
  <pre><code>#include&lt;stdio.h&gt;
  #include&lt;string.h&gt;
  void vuln();
  void win();
  void main(int argc, char *argv[]){
          vuln();
  
  }
  void win (){
          printf("Pwned!!");
  }
  void vuln(){
          char buffer[256];
          printf("Enter a string: ");
          scanf(" %s", buffer);
  }
  </code></pre>
  
  <p>Disassembly of the <code>vuln</code> function: </p>
  
  <pre><code>gef➤  disas vuln
  Dump of assembler code for function vuln:
     0x0000555555555179 &lt;+0&gt;:     push   rbp
     0x000055555555517a &lt;+1&gt;:     mov    rbp,rsp
     0x000055555555517d &lt;+4&gt;:     sub    rsp,0x100
     0x0000555555555184 &lt;+11&gt;:    lea    rdi,[rip+0xe81]        # 0x55555555600c
     0x000055555555518b &lt;+18&gt;:    mov    eax,0x0
     0x0000555555555190 &lt;+23&gt;:    call   0x555555555030 &lt;printf@plt&gt;
     0x0000555555555195 &lt;+28&gt;:    lea    rax,[rbp-0x100]
     0x000055555555519c &lt;+35&gt;:    mov    rsi,rax
     0x000055555555519f &lt;+38&gt;:    lea    rdi,[rip+0xe77]        # 0x55555555601d
     0x00005555555551a6 &lt;+45&gt;:    mov    eax,0x0
     0x00005555555551ab &lt;+50&gt;:    call   0x555555555040 &lt;__isoc99_scanf@plt&gt;
     0x00005555555551b0 &lt;+55&gt;:    nop
     0x00005555555551b1 &lt;+56&gt;:    leave  
     0x00005555555551b2 &lt;+57&gt;:    ret    
  End of assembler dump.
  </code></pre>
  
  <p>I managed to jump to <code>win</code> by using the payload: </p>
  
  <pre><code>&gt;&gt;&gt; payload = "A"264 + p64(0x0000555555555161)
  </code></pre>
  
  <p>The problem is that it didn't print out the string in the function <code>win</code>. All I get was segmentation fault. Here's what I get:</p>
  
  <pre><code>Program received signal SIGSEGV, Segmentation fault.
  0x00007fffffffe158 in ?? ()
  [ Legend: Modified register | Code | Heap | Stack | String ]
  ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── registers ────
  $rax   : 0x7               
  $rbx   : 0x0               
  $rcx   : 0x0               
  $rdx   : 0x0               
  $rsp   : 0x00007fffffffe068  →  0x0000000200000000
  $rbp   : 0x4141414141414141 ("AAAAAAAA"?)
  $rsi   : 0x656e7750        
  $rdi   : 0x00005555555592a0  →  "Pwned!! string: "
  $rip   : 0x00007fffffffe158  →  0x00007fffffffe436  →  "/media/sf_Code/asm/vuln"
  $r8    : 0x00007ffff7fb9500  →  0x00007ffff7fb9500  →  [loop detected]
  $r9    : 0x7               
  $r10   : 0x0000555555556004  →  0x00212164656e7750 ("Pwned!!"?)
  $r11   : 0x246             
  $r12   : 0x0000555555555060  →  &lt;_start+0&gt; xor ebp, ebp
  $r13   : 0x00007fffffffe150  →  0x0000000000000002
  $r14   : 0x0               
  $r15   : 0x0               
  $eflags: [zero carry PARITY ADJUST sign trap INTERRUPT direction overflow RESUME virtualx86 identification]
  $cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000 
  ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── stack ────
  0x00007fffffffe068│+0x0000: 0x0000000200000000   ← $rsp
  0x00007fffffffe070│+0x0008: 0x00005555555551c0  →  &lt;__libc_csu_init+0&gt; push r15
  0x00007fffffffe078│+0x0010: 0x00007ffff7e1ebbb  →  &lt;__libc_start_main+235&gt; mov edi, eax
  0x00007fffffffe080│+0x0018: 0x0000000000000000
  0x00007fffffffe088│+0x0020: 0x00007fffffffe158  →  0x00007fffffffe436  →  "/media/sf_Code/asm/vuln"
  0x00007fffffffe090│+0x0028: 0x0000000200100000
  0x00007fffffffe098│+0x0030: 0x0000555555555145  →  &lt;main+0&gt; push rbp
  0x00007fffffffe0a0│+0x0038: 0x0000000000000000
  ───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── code:x86:64 ────
     0x7fffffffe152                  add    BYTE PTR [rax], al
     0x7fffffffe154                  add    BYTE PTR [rax], al
     0x7fffffffe156                  add    BYTE PTR [rax], al
   → 0x7fffffffe158                  ss     in  al, 0xff
     0x7fffffffe15b                  (bad)  
     0x7fffffffe15c                  (bad)  
     0x7fffffffe15d                  jg     0x7fffffffe15f
     0x7fffffffe15f                  add    BYTE PTR [rsi-0x1c], cl
     0x7fffffffe162                  (bad)  
  ───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
  [#0] Id 1, Name: "vuln", stopped 0x7fffffffe158 in ?? (), reason: SIGSEGV
  ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
  [#0] 0x7fffffffe158 → ss in  al, 0xff
  </code></pre>
  
  <p>How is that the <code>printf</code> didn't print out the string? </p>