Lab12 port 32-bits to 64-bits #132

dariabulacu · 2025-12-08T20:53:29Z

Prerequisite Checklist

Read the contribution guidelines regarding submitting new changes to the project;
Tested your changes against relevant architectures and platforms;
Updated relevant documentation (if needed).

Description of changes

github-actions · 2025-12-09T23:09:39Z

Published at https://cs-pub-ro.github.io/hardware-software-interface/132/

teodutu

Pretty nice work overall. The solution scripts and / or the README guides work. Address my comments and we'll merge this.

teodutu · 2025-12-09T23:04:15Z

.gitignore

+labs/lab-12/tasks/*/solution/buff-ovf*
+!labs/lab-12/tasks/*/solution/buff-ovf*.c
+labs/lab-12/tasks/*/solution/obfuscator
+labs/lab-12/tasks/*/solution/deobfuscator
+labs/lab-12/tasks/*/solution/link
+!labs/lab-12/tasks/*/solution/link.c
+labs/lab-12/tasks/*/solution/link2
+labs/lab-12/tasks/*/solution/dynamic
+!labs/lab-12/tasks/*/solution/dynamic.c
+labs/lab-12/tasks/*/solution/dynamic2
+!labs/lab-12/tasks/*/solution/vuln.c
+labs/lab-12/tasks/*/solution/rop
+!labs/lab-12/tasks/*/solution/rop.c
+labs/lab-12/tasks/*/solution/main
+labs/lab-12/tasks/*/solution/main.o
+labs/lab-12/tasks/*/solution/*.o


Add a .gitignore to each task in lab 12 and exclude or include the files from there.

teodutu · 2025-12-09T23:05:52Z

labs/lab-12/tasks/feeling-chained/support/exploit.sh

Remove the solution from here.

teodutu · 2025-12-09T23:07:58Z

labs/lab-12/tasks/feeling-chained/solution/buff-ovf3.c

+/* ROP gadgets for x86-64 */
+void gadget_pop_rdi(void)
+{
+	__asm__("pop %rdi; ret");
+}
+
+void gadget_pop_rsi(void)
+{
+	__asm__("pop %rsi; ret");
+}


You generally find pop rdi; ret and pop rsi; ret gadgets in regular binaries. Why do you need these here?

In this binary, compiled with -no-pie and -fno-stack-protector, it doesn't generate any gadgets naturally. Therefore I need to add them manually because the gcc copies the values directly to the stack and the only pop ; ret there is is for the frame pointer rbp.

labs/lab-12/tasks/hidden-in-plain-sight-1/solution/README.md

teodutu · 2025-12-09T23:12:13Z

labs/lab-12/tasks/hidden-in-plain-sight-1/solution/README.md

-`gcc -no-pie -m32 link main.o -o a.out`
+
+```bash
+gcc -no-pie -m64 link main.o -o a.out


Update the link object file to be compiled on 64 bits.

teodutu · 2025-12-09T23:23:57Z

labs/lab-12/tasks/rip-my-buffers-off/support/exploit.sh

+padding_length="56"
+address="\x16\x12\x40\x00\x00\x00\x00\x00"


Remove the solution from here.

labs/lab-12/tasks/rop/solution/README.md

teodutu · 2025-12-09T23:25:51Z

labs/lab-12/tasks/rop/support/exploit.sh

Remove the solution. Keep the strings empty and leave the solution in ../solution/.

teodutu · 2025-12-09T23:26:45Z

labs/lab-12/tasks/rop/solution/README.md

+**Key Differences from 32-bit**:
+
+- Parameters in registers (RDI, RSI) instead of stack
+- Addresses are 8 bytes (not 4)
+- No need for `pop r15` or extra stack cleanup
+- Simpler ROP chain structure


Remove these lines. Students won't study 32 bits anymore.

teodutu · 2025-12-09T23:27:57Z

labs/lab-12/tasks/rop/solution/rop.c

+void gadget_pop_rdi(void)
+{
+	__asm__("pop %rdi; ret");
+}
+
+void gadget_pop_rsi(void)
+{
+	__asm__("pop %rsi; ret");
+}


Don't add these gadgets manually. You'll most likely find them in the binary, they're pretty common.

This commit ports all Lab 12 CTF tasks from x86 (32-bit) to x86-64 (64-bit) architecture. Tasks ported: - feeling-chained: ROP chain with custom gadgets - hidden-in-plain-sight-1: Object file linking - hidden-in-plain-sight-2: Object file with parameters - indirect-business: Buffer overflow exploit - look-at-him-go: GDB debugging exercise - playing-god: Random number guessing - rip-my-buffers-off: Return address overwrite - rop: ROP chain to call special_function(6,9) Key changes: - Updated all Makefiles with -m64 compilation flag - Adapted ROP chains to use 64-bit registers (RDI, RSI) - Changed addresses from 4 bytes to 8 bytes (little-endian) - Updated padding for 64-bit stack alignment - Modified exploit scripts for 64-bit exploitation - Updated READMEs with comprehensive x86-64 explanations - Fixed all linting issues (trailing whitespace, markdownlint) All tests passing: 100/100 for each task. Signed-off-by: Daria Bulacu <dariabulacu@yahoo.com>

teodutu

Nearly there.

teodutu · 2025-12-12T22:36:14Z

labs/lab-12/tasks/feeling-chained/solution/README.md

 `f3` is the one that actually calls `get_flag()`.
 Calling `get_flag()` directly shouldn't work (a global variable is checked to make sure all steps were made).

+## x86-64 (64-bit) Solution


Suggested change

## x86-64 (64-bit) Solution

All is 64 bits, no need to write it.

teodutu · 2025-12-12T22:40:48Z

labs/lab-12/tasks/feeling-chained/solution/README.md

+With static linking, natural ROP gadgets from libc are available:
+
+- `pop rdi; pop rbp; ret` at `0x4022c8`
+- `pop rsi; pop rbp; ret` at `0x4050a6`
+
+Since these gadgets also pop RBP, we need dummy values after each parameter.


Add a section in the lab's reading/ file about ROPgadget and instruct students how to install and use it:

teo@astrocat support $ pip3 install ROPgadget teo@astrocat support $ ROPgadget --binary buff-ovf3 | grep 'pop rdi' 0x00000000004013d8 : cli ; push rbp ; mov rbp, rsp ; pop rdi ; ret 0x00000000004013d5 : endbr64 ; push rbp ; mov rbp, rsp ; pop rdi ; ret 0x00000000004013db : mov ebp, esp ; pop rdi ; ret 0x00000000004013da : mov rbp, rsp ; pop rdi ; ret 0x00000000004013dd : pop rdi ; ret 0x00000000004013d9 : push rbp ; mov rbp, rsp ; pop rdi ; ret teo@astrocat support $ ROPgadget --binary buff-ovf3 | grep 'pop rsi' 0x00000000004013e5 : cli ; push rbp ; mov rbp, rsp ; pop rsi ; ret 0x00000000004013e2 : endbr64 ; push rbp ; mov rbp, rsp ; pop rsi ; ret 0x00000000004013e8 : mov ebp, esp ; pop rsi ; ret 0x00000000004013e7 : mov rbp, rsp ; pop rsi ; ret 0x00000000004013ea : pop rsi ; ret 0x00000000004013e6 : push rbp ; mov rbp, rsp ; pop rsi ; ret

ROPgadget is cool because it also looks at arbitrary offsets in the text section so those instructions may not exist explicitly, for example the end of an instruction + the beginning of the next one can create a gadget.

In addition, using pop rbp fucks up the stack and the solution script causes seg faults with no result.

teodutu · 2025-12-12T22:45:48Z

labs/lab-12/tasks/indirect-business/support/exploit.sh

 # TODO set the right string

-payload=""
+payload="AAAAAAAAAABye"


Bump for this: remove the solution.

teodutu · 2025-12-12T22:47:48Z

labs/lab-12/tasks/playing-god/solution/README.md

+Or use GDB to extract and calculate:
+
+```bash
+gdb -batch -ex "break *main+67" -ex "run" -ex "print \$eax % 100000" ./dynamic2 < /dev/null


Don't forget to apply my suggestion above.

teodutu · 2025-12-12T22:49:04Z

labs/lab-12/tasks/rop/solution/README.md

+- `pop rdi; pop rbp; ret` at `0x402268`
+- `pop rsi; pop rbp; ret` at `0x405046`


Same as for feeling-chained: use ROPgadget to avoid pop rbp.

dariabulacu force-pushed the lab12-update branch 4 times, most recently from ac0802d to 06730ec Compare December 9, 2025 14:28

teodutu linked an issue Dec 9, 2025 that may be closed by this pull request

labs/lab-12: Add x86_64 version #88

Open

teodutu added the needs-rendering The PR makes changes to the website that need to be rendered label Dec 9, 2025

teodutu requested changes Dec 9, 2025

View reviewed changes

dariabulacu force-pushed the lab12-update branch 3 times, most recently from d572237 to e56ae7d Compare December 10, 2025 18:20

dariabulacu force-pushed the lab12-update branch from e56ae7d to ae9de1e Compare December 12, 2025 10:13

teodutu requested changes Dec 12, 2025

View reviewed changes

		padding_length="56"
		address="\x16\x12\x40\x00\x00\x00\x00\x00"

		- `pop rdi; pop rbp; ret` at `0x402268`
		- `pop rsi; pop rbp; ret` at `0x405046`

Lab12 port 32-bits to 64-bits #132

Are you sure you want to change the base?

Lab12 port 32-bits to 64-bits #132

Uh oh!

Conversation

dariabulacu commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Prerequisite Checklist

Description of changes

Uh oh!

github-actions bot commented Dec 9, 2025

Uh oh!

teodutu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

teodutu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dariabulacu commented Dec 8, 2025 •

edited

Loading