# Buffer Overflow Demo — IERG4130 (Memory Vulnerability and Defense)

Files
  vul.c        the vulnerable program (unbounded strcpy into a 100-byte stack buffer)
  exploit.py   builds `badfile` with a single hard-coded return address (naive, often misses)
  verify.py    end-to-end: compile -> find offset with gdb -> prove EIP control -> pop a real /bin/sh
  brute32.py   defeat 32-bit stack ASLR by brute force (probabilistic; Shacham et al. 2004)

Environment
  Linux x86-64 with 32-bit toolchain:  sudo apt install gcc-multilib gdb
  Disable ASLR per-process (no root):  setarch -R ./vul

Build (protections OFF, to study the raw mechanism only)
  gcc -g -o vul -m32 -z execstack -fno-stack-protector -no-pie vul.c

Run the full, self-checking exploit
  python3 verify.py
    1) compile + confirm exec stack   (readelf -l vul | grep GNU_STACK -> RWE)
    2) find offset with gdb            (measured, not guessed -> 112)
    3) prove EIP control               (ret <- "BBBB" -> $pc = 0x42424242)
    4) sweep the return address        (into the NOP sled -> a real /bin/sh)

Why sweep? gdb's &buffer differs from a real run's (gdb adds its own env/argv to the
stack), so a single fixed RET often misses. A big NOP sled + sweeping ret = buf + k
lands execution in the sled anyway.

For teaching use only — these flags recreate a 1990s-style vulnerable target.
