Article can be found here.

I'm reading up on smashing the stack and have found myself to be getting stuck on example3.c.

0x80004a3 <main+19>:    call   0x8000470 <function>
0x80004a8 <main+24>:    addl   $0xc,%esp
0x80004ab <main+27>:    movl   $0x1,0xfffffffc(%ebp)
0x80004b2 <main+34>:    movl   0xfffffffc(%ebp),%eax

The author indicates that we want to skip from 0x80004a8 to 0x80004b2 and that this jump is 8 bytes; how has the author determined this is 8 bytes? I have recreated the code and sent it through objdump and found that it's not 8 bytes (I am on a 64 bit machine but I've made sure to compile using 32 bit):

8048452:    e8 b5 ff ff ff          call   804840c <function>
8048457:    c7 44 24 1c 01 00 00    movl   $0x1,0x1c(%esp)
804845e:    00 
804845f:    8b 44 24 1c             mov    0x1c(%esp),%eax
8048463:    89 44 24 04             mov    %eax,0x4(%esp)
8048467:    c7 04 24 18 85 04 08    movl   $0x8048518,(%esp)

The author also said "How did we know to add 8 to the return address? We used a test value first (for example 1)" Where did he use this test value at?

c stack-overflow buffer-overflow disassembly
Edit
Report