下面将通过一段代码分析x86_32栈的使用方法,程序运行后不停的重新调用main函数重新运行。
原理:
In x86_32, When one function named ‘function_A’
call another function named ‘function_B’
the function_B’s stack look like below:
Parameter #N <—- N*4+4(%ebp)
…
Parameter #2 <—- 12(%ebp)
Parameter #1 <—- 8(%ebp)
Return Address <—- 4(%ebp)
Old %ebp <—- (%ebp)
Local Variable 1 <—- -4(%ebp)
Local Variable 2 <—- -8(%ebp)
…
So, We can’t use Paremeter or local variable get the address which store the
Return Address and change it.
#include <stdio.h>
void modify_return_address(int num);
int main(int argc, const char **argv)
{
printf("%s %d\n", __func__, __LINE__);
modify_return_address(1);
printf("%s will return\n", __func__);
return 0;
}
void modify_return_address(int num)
{
int *return_address = (int *)((char *)(&num) - 4);
*return_address = (int )(main);
return;
}