Install the Python ropper tool by running pip install ropper.

Practice using Python to generate strings of arbitrary bytes (like those .dat files associated with our lectures) by creating and then outputting byte strings. See Bytes and Unicode Strings as well as help(bytes.fromhex).

Download vulnerable.c and compile it into an executable.

Using a debugger and the data file 1x1 or 4x4, illustrate the contents of the stack just before returning from the load_matrix function (i.e., at line 71 or 72). Show the stack contents from the address in %rsp to the call’s return address. Highlight all parameters, local variables and the return address.

Use a debugger to explain why the fuzzer-generated test cases crash0 and crash1 crash the vulnerable binary.

Create an input file that will cause load_matrix to zero out the stack from matrix to the return address. Use the debugger to verify that the file is successfully read and that the correct address is zeroed out. Why does the program fail to run to completion?

Modify your input file so that the values of file_size and HEADER_SIZE are preserved when the stack is overwritten. Demonstrate that the program now terminates by attempting to execute code at address 0.

Use the ropper tool to generate a ROP-chain payload for the vulnerable-provided binary that I gave you earlier. This ROP chain should execute the shell /bin/sh. Pass this payload into the vulnerable-provided binary and, using the debugger, explain why the process crashes.

Required for ENGI 9823, optional for ENGI 7420: Modify the ROP chain (in Python or in the binary file) to successfully execute the ROP chain. Use the debugger to demonstrate how execution passes through at least the first three gadgets of the chain. Demonstrate that the end result is a shell.