From 2018bf98c1cc0dbdc73f13c8d567c2460252845d Mon Sep 17 00:00:00 2001 From: Malfurious Date: Fri, 30 Jul 2021 01:07:31 -0400 Subject: Document various low-level C IO characteristics Signed-off-by: Malfurious --- docs/pwn/libc_io.txt | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 docs/pwn/libc_io.txt diff --git a/docs/pwn/libc_io.txt b/docs/pwn/libc_io.txt new file mode 100644 index 0000000..b48537b --- /dev/null +++ b/docs/pwn/libc_io.txt @@ -0,0 +1,29 @@ +Just some things to consider when crafting a pwn payload... + + +Notes +----- +* The functions documented here require: stdio.h, unistd.h +* The terminator 'space' means any whitespace, newline, tab, etc. +* '?' on an output terminator means it is only sometimes present, see notes. +* See man 2/3 for complete information + + +[INPUT] + +Function Arguments Return val Input terminators Output terminators Source Notes +=================================================================================================================================================================================================== +gets (char*)dest dest, NULL '\n', EOF '\0' STDIN No check for buffer overrun +scanf(%s) (char*)format, ... # matched items, EOF space, maxlen, EOF '\0' STDIN No check for buffer overrun +fgets (char*)dest, (int)size, (FILE*)src dest, NULL '\n', maxlen, EOF '\n'? '\0' src Newline char stored into output if read +read (int)fd, (void*)dest, (size_t)size # bytes read, -1 maxlen, EOF [none] fd Binary IO, may read < size or follow-up input if available + + +[OUTPUT] + +Function Arguments Return val Input terminators Output terminators Dest Notes +=================================================================================================================================================================================================== +puts (char*)str >=0, EOF '\0' '\n' STDOUT Extra newline char is always appended +printf(%s) (char*)format, ... # chars printed, <0 '\0' [none] STDOUT Output controlled by format string +fputs (char*)str, (FILE*)dest >=0, EOF '\0' [none] dest Unlike puts(), does not append '\n' +write (int)fd, (void*)src, (size_t)size # bytes written, -1 maxlen [none] fd Binary IO, may write < size under certain conditions -- cgit v1.2.3