Is it possible to restore the stack frame so that the EIP returns to the place that is was at(before the overflow) after a payload has been executed?

If a stack frame is overflowed and the payload executed, how can the vulnerable application be restored so it continues to function as it was before?

If the EIP is overwritten with the address to the start of the payload or NOP sled and lets say it spawns a shell, does that spawned shell keep the stack frame paused? Or what exactly happens after the payload is run and the EIP is read again? Wont it cause an infinite loop inside the stack frame?


Technically it seems to be possible, but only in case you know the code path (i.e. you know the exploit would be triggered only from a specific address of the application). Seems like what you need to do is:

  • Overwrite only the return address on stack (and nothing else);
  • In your executed code store the old ESP/RSP in one of the throwaway registers, and set it to somewhere else (so your operations do not damage stack - may not be necessary if you're sure your shellcode will not damage stack content);
  • Store all registers which must be preserved across the function calls;
  • Do what you need to do;
  • Restore the preserved registers and stack pointer;
  • Assign a proper return value (if the function returns a value) into a proper register(s);
  • Jump to the specific address after from where the function which you exploited was called from.

A spawned shell in this case may use a dedicated stack, or even the original stack. Since it grows down, if the code uses the stack properly, it will not damage the original stack content which was put there before the invocation.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.