int main()
{
printf(&unix["/021%six/012/0"], (unix)["have"] + "fun" - 0x60);
}
gcc -S编译成汇编代码如下:
.file "test.c"
.section .rodata
.LC0:
.string "fun"
.LC1:
.string "/021%six/n"
.string ""
.text
.globl main
.type main,@function
main:
pushl %ebp
movl %esp, %ebp
subl $8, %esp
andl $-16, %esp
movl $0, %eax
subl %eax, %esp
subl $8, %esp
movl $.LC0, %eax
subl $96, %eax
addl $97, %eax
pushl %eax
pushl $.LC1+1
call printf
addl $16, %esp
leave
ret
.Lfe1:
.size main,.Lfe1-main
.section .note.GNU-stack,"",@progbits
.ident "GCC: (GNU) 3.2.3 20030502 (Red Hat Linux 3.2.3-47)"
关键点:
1.linux下有宏定义 MACRO unix = 1
2.对数组的理解1["have"] <==> "have"[1]
&1["abcd"]就是'b'的地址
3.C语言对转义的规定 /ddd 为1~3位八进制数所代表的字符 /xhh表示1~2位16进制数所代表的字符,故/021表示ASCII值为十进制17的字符;/012表示换行符;/0就是字符串结束符