Handing bytes as command line argument to program

Question

I am trying to exploit a buffer overflow vulnerability. To do so, I want to pass an address that was previously determined (such as \x00\x00\x41\xab\x00\xab ) to a program such that it will be written to the memory as bytes, not the byte representation of the input string. Consider the example:

Address I want to write as hex string: \x00\x00\x41\xab\x00\xab 

Memory before overflow: ab ab 00 00 aa 00  (these values could be arbitrary since its stack memory) 
Memory after overflow : 00 00 41 ab 00 ab

The buffer I am trying to write to is accesses in the following way:

void overflow(char input[], end){
    for(int a = 0; a < end; ++a){
        char buffer[32];
        buffer[a] = input[a];
}

The value of end is determined by the length of input . The overflow is irrelevant for my question. What I am asking is:

How can I pass an address in whatever representation (hex, bytestring, etc.) to the program as a command line argument (via argv[] ), such that it is written to memory as shown above?

Especially, how do I deal with \x00 characters?

I found this question, which unfortunately didn't provide a solution. Note that I am not trying to pipe the parameters, since the program does not read from stdin.

Answer 1

I would take the input as a text string like "000041ab00ab" and then write some simple code to do the conversion.

Something like:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

unsigned char conv_char(char c)
{
        if (c >= '0' && c <= '9')
        {
            return c - '0';
        }
        
        if (c >= 'a' && c <= 'f')
        {
            return c - 'a' + 10;
        }
        
        exit(1);
}

void get_values(const char* str, unsigned char* values)
{
    if (strlen(str) != 12) exit(1);
    for (int i=0; i < 6; ++i)
    {
        values[i] = conv_char(str[2*i]);
        values[i] = values[i] << 4;
        values[i] = values[i] | conv_char(str[2*i + 1]);
    }
}

int main(int argc, char* argv[]) 
{
    if (argc != 2) exit(1);
    unsigned char values[6];
    get_values(argv[1], values);
    
    for (int i=0; i < 6; ++i)
    {
        printf("0x%02x ", values[i]);
    }    
    puts("");
    
    return 0;
}

Running this as prog 000041ab00ab gives the output:

0x00 0x00 0x41 0xab 0x00 0xab