I was trying to overflow the return pointer of a simple program. I have asrl disabled and I compiled like this gcc returnexp.c -o returnexp -fno-stack-protector.
(I would disable noexecstack later on when I could overwrite the pointer) But everytime I overwrite the pointer, I get this error and it's not even loading the Charakters into rip so I cannot calculate the offset, nor even return to my stackframe. What can I do?
Looks like your payload is a large number of As (0x41). In 32-bit x86, it is indeed possible to have a payload such that EIP is set to nearly any arbitrary address, such as 0x41414141. However, in 64-bit (x86-64), the possible address space is massive, so systems don't actually allow the entire thing to be used.
See this excerpt from the AMD64 Architecture Programmer’s Manual Volume 2: System Programming:
5.3.1 Canonical Address Form
The AMD64 architecture requires implementations supporting fewer than the full 64-bit virtual address to ensure that those addresses are in canonical form. An address is in canonical form if the address bits from the most-significant implemented bit up to bit 63 are all ones or all zeros. If the addresses of all bytes in a virtual-memory reference are not in canonical form, the processor generates a general-protection exception (#GP) or a stack fault (#SS) as appropriate
The Wikipedia page for x86-64, citing this, summarizes the implications nicely:
In addition, the AMD specification requires that the most significant 16 bits of any virtual address, bits 48 through 63, must be copies of bit 47 (in a manner akin to sign extension). If this requirement is not met, the processor will raise an exception.[11]: 131 Addresses complying with this rule are referred to as "canonical form."[11]: 130 Canonical form addresses run from 0 through 00007FFF'FFFFFFFF, and from FFFF8000'00000000 through FFFFFFFF'FFFFFFFF, for a total of 256 TiB of usable virtual address space. This is still 65,536 times larger than the virtual 4 GiB address space of 32-bit machines.
So TL;DR, 0x4141414141414141 is not at all a valid address on x86-64 and an exception is raised even before jumping to it (unlike on x86 where the exception appears to be raised after jumping to an unmapped or non-executable page). You could try another address such as 0xffffffffffffffff if you want, and that will result in RIP being set as you expect, though this isn't really useful besides proving a point.
So to carry on with exploitation, you need to take a step back. Where is the return address stored before it is popped into RIP? It's at the bottom of the stack. If you were to inspect the stack contents at the time of crash, you would see the address it's trying to return to (0x4141414141414141) is stored on the stack where RSP is pointing. So when you are trying to determine the RIP offset using a pattern, you'll want to look at the value on the stack at RSP.
