the c code:
void overflow (char* inbuf)
{
char buf[64];
strcpy(buf, inbuf);
}
int main (int argc, char** argv)
{
overflow(argv[1]);
return 0;
}
-
2please do not add code as an image next timePaweł Łukasik– Paweł Łukasik2019-02-18 07:03:58 +00:00Commented Feb 18, 2019 at 7:03
Add a comment
|
1 Answer
It actually does. The push operation is performed by the call instruction. This instruction will push the address of the next instruction, here the address is 0x21. From 0x21 to 0x28 you have your /bin/sh string which is, on your case, wrongly disassembled as x86 code. Last but not least, the linux x86 32-bit syscall calling convention doesn't use the stack at all. The parameters are passed through ebx, ecx, edx, esi, edi, ebp and the syscall number is stored in eax.
-
A little correction: The code shown is the old calling convention using
int 0x80which uses afaik the stack for parameters and not the registers. The registers are only used for the newsyscallconvention.Uwe Plonus– Uwe Plonus2019-02-18 20:45:23 +00:00Commented Feb 18, 2019 at 20:45