Don't forget the null bytes
c programming system exploitJust a link to a good post.
Why do I care about this? It’s because null bytes are not just string
terminators. They may also terminate arrays, e.g. terminating the argv
array. So, say you are overwriting a buffer, preparing it to be argv for an
execve
syscall. Make sure to put a null byte or execve will return an error
and you’ll never get the result of the execve command you worked so hard for..
Why do we need a null terminator for the argv array if we pass argc?
This is apparently a historical issue, as K&R did not originally mention a null
terminator, but did use argc. Later, ANSI C required argv[argc]
to be a null
byte. See
here.