Hands-On Penetration Testing on Windows

Finding the .bss address

We need to work with the program's design to write data somewhere. We can use the .bss section of our executable for this task, as .bss is a place to put variables that don't have any value just yet. It's essentially space set aside for these variables, and thus it won't occupy space within the object file. For our purposes here, we just need to know where it is. Use the info file command in gdb to get a list of the sections with their ranges and take down the initial address of .bss:

# gdb buff(gdb) info file