Edit Question - KnowledgeHub

Title Body

Article can be found here . I'm reading up on smashing the stack and have found myself to be getting stuck on example3.c. 0x80004a3 <main+19>: call 0x8000470 <function> 0x80004a8 <main+24>: addl $0xc,%esp 0x80004ab <main+27>: movl $0x1,0xfffffffc(%ebp) 0x80004b2 <main+34>: movl 0xfffffffc(%ebp),%eax The author indicates that we want to skip from 0x80004a8 to 0x80004b2 and that this jump is 8 bytes; how has the author determined this is 8 bytes? I have recreated the code and sent it through objdump and found that it's not 8 bytes (I am on a 64 bit machine but I've made sure to compile using 32 bit): 8048452: e8 b5 ff ff ff call 804840c <function> 8048457: c7 44 24 1c 01 00 00 movl $0x1,0x1c(%esp) 804845e: 00 804845f: 8b 44 24 1c mov 0x1c(%esp),%eax 8048463: 89 44 24 04 mov %eax,0x4(%esp) 8048467: c7 04 24 18 85 04 08 movl $0x8048518,(%esp) The author also said " How did we know to add 8 to the return address? We used a test value first (for example 1) " Where did he use this test value at?

Tags (comma-separated) Cancel