Failed vs Real Hack
Attack Methodology
Failed Attempt
The Bad Idea
Set r0 to point
at a string literal
like "hacky"
Why It Fails
r0 only holds a
32-bit number
Not a string itself!
set $r0 = "HACK"
GDB interprets this
as an address value
pointing to garbage
Result: CRASH
or prints garbage
Real Hack
The Right Way
1. Write string
bytes to SRAM
2. Point r0 to
that SRAM addr
GDB Commands
set {char[13]}0x20040000
= "hacky, world"
set $r0 = 0x20040000
String exists in
writable SRAM
r0 points to it
"hacky, world" printed!