title: Offbyone buffer overflow NULL byte in payload
body: <p>So I was trying Offbyone Buffer overflow with the help of this following simple  code </p>
  
  <pre><code>#include &lt;string.h&gt;
  
  void cpy(char *x){
  char buf[128]="";
  strncat(buf,x,sizeof(buf));
  
  }
  int main(int argc, char **argv)
  {
  
      cpy(argv[1]);
  
  }
  </code></pre>
  
  <p>As this diagram depicts how an Offbyone buffer over flow works </p>
  
  <p><a href="https://i.stack.imgur.com/wwP9I.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/wwP9I.png" alt="enter image description here"></a></p>
  
  <p>Taken from : <a href="https://www.sans.org/reading-room/whitepapers/threats/buffer-overflows-dummies-481" rel="nofollow noreferrer">https://www.sans.org/reading-room/whitepapers/threats/buffer-overflows-dummies-481</a></p>
  
  <p>Here is the Disassembly of main and cpy 
  <a href="https://i.stack.imgur.com/1OPSZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/1OPSZ.png" alt="enter image description here"></a></p>
  
  <p><a href="https://i.stack.imgur.com/8NvKT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/8NvKT.png" alt="enter image description here"></a></p>
  
  <p><strong>Here is the payload that I used</strong>
  <a href="https://i.stack.imgur.com/vMw7a.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/vMw7a.png" alt="enter image description here"></a></p>
  
  <p><strong>Memory dumps</strong></p>
  
  <p><a href="https://i.stack.imgur.com/cMzpV.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/cMzpV.png" alt="enter image description here"></a></p>
  
  <p>So using the buffer , in the Cpy stack frame i change the value of the saved RBP's <strong>least significant byte</strong> to <strong>00</strong> ( <em>because of the Offbyone overflow achieved by providing exactly 128byte input</em>  )</p>
  
  <p>As you can see the address <strong>0x7fffffffe177</strong> has stored EBP whose value is changed from <strong>0x7fffffffe190</strong> to <strong>0x7fffffffe100</strong></p>
  
  <p>So I went ahead and had the starting address of my payload at the address <strong>0x7fffffffe10F</strong> <em>which is also the return address of main</em>
  which is supposed to be <strong>0xffffe110    0x00007fff</strong> instead of <strong>0xffffe110    0x90907fff</strong> but since we shouldn't have 00 in payload  I am not able to set the return address because since it's an 64bit address is of 8byte long   <strong>0xffffe110 0x00007fff</strong></p>
  
  <p>So how exactly should we have the return address here ? 
  And since the image of the memory dump, in break point 1 , its the cpy function frame why is argc  and argv [] on the top of the stack ? 
  I am new to Exploit writing and all the help will be much appreciated .</p>