I'm trying to understand buffer overflow, and am working with a simple piece of code, as below.
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int bof(char *str)
{
char buffer[12];
strcpy(buffer,str);
return 1;
}
int main(int argc, char **argv)
{
char str[517];
FILE *badfile;
badfile = fopen("badfile", "r");
fread(str, sizeof(char), 517, badfile);
bof(str);
printf("Returned Properly\n");
return 1;
}
I understand I need to inject the shell code in "badfile", suppose I create a badfile like this:
char buffer[517];
FILE *badfile;
memset(&buffer, 0x90, 517);
badfile = fopen("./badfile", "w");
fwrite(buffer, 517, 1, badfile);
Do I inject it at index 12th of buffer[]? I'm facing a problem with that. But I believe that is because it's not the return position. Do I have to calculate the return position? Thanks.
AAAAAAAAAAAAAAAAAAAAAAAA
... and watch this code run in a debugger.