Exploiting Buffer Overflows on RISC-V
summary
RISC-V stack overflows are demonstrated end-to-end: a vulnerable C program is exploited on a qemu image to overwrite return addresses, spawn a shell, and implement ret2libc/ROP chains. The talk shows how little-endian byte ordering, 2/4‑byte instruction alignment, and 32 general-purpose registers change payload layout, how null bytes force shellcode rewrites, and that ASLR must be disabled for reliable results. Tools and artifacts include objdump -D to find gadgets, a Python payload generator, and live debugging with gdb (fixedenv used to stabilize stack addresses).
AI-written summary · about
chapters (24)
- 0:00Introduction
- 0:33Agenda
- 3:23License Fees
- 4:39Architecture
- 9:47Important registers
- 13:03Local variables
- 13:40Hacking
- 13:56Buffer Overflow
- 15:04Approach
- 16:36Shell Code
- 17:41Buffer Size
- 20:43Snail bites
- 21:16Using odd numbers
- 21:48Using larger numbers
- 22:14Writable stack
- 22:41Shellcode
- 22:55Overwrite Buffer
- 23:26Program nominee
- 24:52Object dump
- 25:50Fill the buffer
- 26:57Fix the stack
- 28:10Questions
- 31:19Userspace
- 35:59Outro
related talks
36mExploiting Buffer Overflows on RISC-V
47mA Security RISC? The State of Microarchitectural Attacks on RISC-V
22mDemostrating Binary Exploitation
51mThe Anatomy of an Exploit
57mThe Anatomy of an Exploit
57mReturn Oriented Programming, an introduction
46mRIDLed with CPU bugs
57mReturn Oriented Programming, an introduction