4. The following function is called in a privileged program. The argument str points to a...

 

Transcribed Image Text:

4. The following function is called in a privileged program. The argument str points to a string that is entirely provided by users (the size of the string is up to 300 bytes). When this function is invoked, the address of the buffer array is 0x66DD0010, while the return address is stored in 0x66DD0050. Please write down the string that you would feed into the program, so when this string is copied to buffer and when the bof() function returns, the privileged program will run your code. In your answer, you don't need to write down the injected code, but the offsets of the key elements in your string need to be correct. (10') int bof (char *str) { char buffer [24]; strcpy (buffer, str); return 1; 4. The following function is called in a privileged program. The argument str points to a string that is entirely provided by users (the size of the string is up to 300 bytes). When this function is invoked, the address of the buffer array is 0x66DD0010, while the return address is stored in 0x66DD0050. Please write down the string that you would feed into the program, so when this string is copied to buffer and when the bof() function returns, the privileged program will run your code. In your answer, you don't need to write down the injected code, but the offsets of the key elements in your string need to be correct. (10') int bof (char *str) { char buffer [24]; strcpy (buffer, str); return 1;

Answer rating: 100% (QA)

One must build a string that is longer than the buffers maximum size 24 bytes and repla... View the full answer