forensicsProeasy

Forenser RBP

spbctf

Task: raw process stack dump (0x21000 bytes) from /proc/PID/maps region 0x7ffc1efb8000-0x7ffc1efd9000, find saved RBP of the function that returns to main. Solution: walk the x86_64 RBP linked-list chain (push rbp; mov rbp, rsp) and take the last saved RBP still pointing inside the stack region — that is main's RBP.

$ ls tags/ techniques/
x86_64memory_dumpstack_forensicsrbp_chainframe_pointerpwn_adjacent
rbp_chain_walkingframe_pointer_traversalstack_dump_analysisva_range_from_filename
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups