previous | start | next

How?

1. Use gdb to determine ebp value and beginning address of character
   array. 

2. Use gcc -S to generate the assembly code for the attack
   function.

3. Copy the code and add the pushl instruction to push main's return
   address on the stack in a file named attack2.s. Then use gcc -c
   attack2.s to assemble this code in to object file attack2.o

4. Use objdump on the object file attack2.o to get the byte encoding
   of the function we want.

5. Append padding bytes (00 or 90) if necessary to the bytes from 4
   and then add main's ebp value and the beginning address of the char
   array buf where this code will be copied by getsx.


previous | start | next