21 lines
1.2 KiB
Plaintext
21 lines
1.2 KiB
Plaintext
After some Google and asking Mr. GPT I found out that the return address is usually stored at the allocated stack size + 8 bytes on x86. So I disassembled assignment1c and found the following assembly code:
|
|
|
|
0x0000000000401168 <+0>: push %rbp
|
|
0x0000000000401169 <+1>: mov %rsp,%rbp
|
|
0x000000000040116c <+4>: sub $0x90,%rsp
|
|
0x0000000000401173 <+11>: lea -0x90(%rbp),%rax
|
|
0x000000000040117a <+18>: mov %rax,%rdi
|
|
0x000000000040117d <+21>: call 0x401040 <gets@plt>
|
|
0x0000000000401182 <+26>: mov 0x8(%rbp),%rax
|
|
0x0000000000401186 <+30>: mov %rax,-0x8(%rbp)
|
|
0x000000000040118a <+34>: mov -0x8(%rbp),%rax
|
|
0x000000000040118e <+38>: lea 0xe7b(%rip),%rdx # 0x402010
|
|
0x0000000000401195 <+45>: mov %rax,%rsi
|
|
0x0000000000401198 <+48>: mov %rdx,%rdi
|
|
0x000000000040119b <+51>: mov $0x0,%eax
|
|
0x00000000004011a0 <+56>: call 0x401030 <printf@plt>
|
|
0x00000000004011a5 <+61>: nop
|
|
0x00000000004011a6 <+62>: leave
|
|
|
|
What we can see here is that with lea we allocate a size of 0x90 = 144 bytes. So with 144 + 8 being 152, I have to write 152 'A' characters and then put in my return address. So that's how the stack-c.sh file works.
|