previous | start | next

What code, where?

1. The getsx function lets you type in characters such as 3f 1a 05 and
   converts each pair of characters to the a single 8 bit byte with
   the corresponding hex value; e.g., 0x3f, 0x1a, 0x05.

2. Devise an input string that is the byte encoding of a function that
   simply returns the value 0xdeadbeef.

3. Key: Pad this input string so that it overwrites the char
   array in getbuf and in fact overwrites the return address on the
   stack:

                 +-------------+
                 |             | <- input string will be stored in here
                 |             |
                 |             |   getbuf's stack frame
                 | main's ebp  |
                 +-------------+
                 |ret in main  |  Overwrite this address with a new one
                 +-------------+
                 |             |
                 |             |
                 |             |   main's stack frame
                 |             |
                 |             |
                 +-------------+

4. The new return address should simply be the address back in
   getbuf's stack frame where the input string is stored in the buf
   array. 



previous | start | next