Chapter 13, Problem 2RQ

Returns an US standard formatted phone number, in the format of      (xxx) xxx-xxxx           the AreaCode, Prefix and number being each part in order.           Testing Hint: We be exact on the format of the number when      testing this method. Make sure you think about how to convert      33 to 033 or numbers like that when setting your string format. Reminder      the %02d - requires the length to be 2, with 0 padding at the front if a single      digit number is passed in.

The next problem concerns the following C code: /copy input string x to buf */ void foo (char *x) { char buf [8]; strcpy((char *) buf, x); } void callfoo() { } foo("ZYXWVUTSRQPONMLKJIHGFEDCBA"); Here is the corresponding machine code on a Linux/x86 machine: 0000000000400530 : 400530: 48 83 ec 18 sub $0x18,%rsp 400534: 48 89 fe mov %rdi, %rsi 400537: 48 89 e7 mov %rsp,%rdi 40053a: e8 d1 fe ff ff 40053f: 48 83 c4 18 add callq 400410 $0x18,%rsp 400543: c3 retq 0000000000400544 : 400544: 48 83 ec 08 sub $0x8,%rsp 400548: bf 00 06 40 00 mov $0x400600,%edi 40054d: e8 de ff ff ff callq 400530 400552: 48 83 c4 08 add $0x8,%rsp 400556: c3 This problem tests your understanding of the program stack. Here are some notes to help you work the problem: • strcpy(char *dst, char *src) copies the string at address src (including the terminating '\0' character) to address dst. It does not check the size of the destination buffer. You will need to know the hex values of the following characters:

A ROP (Return-Oriented Programming) attack can be used to execute arbitrary instructions by chaining together small pieces of code called "gadgets." Your goal is to create a stack layout for a ROP attack that calls a function located at '0x4018bd3'. Below is the assembly code for the function 'getbuf', which allocates 8 bytes of stack space for a 'char' array. This array is then passed to the 'gets' function. Additionally, you are provided with five useful gadgets and their addresses. Use these gadgets to construct the stack layout. Assembly for getbuf 1 getbuf: 2 sub $8, %rsp 3 mov %rsp, %rdi 4 call gets 56 add $8, %rsp ret #Allocate 8 bytes for buffer #Load buffer address into %rdi #Call gets with buffer #Restore the stack pointer #Return to caller. Stack Layout (fill in Gadgets each 8-byte section) Address Gadget Address Value (8 bytes) 0x4006a7 pop %rdi; ret 0x7fffffffdfc0 Ox4006a9 pop %rsi; ret 0x7fffffffdfb8 0x4006ab pop %rax; ret 0x7fffffffdfb0 0x7fffffffdfa8 Ox4006ad mov %rax,…