While I was studying
ret2libc, I saw that tutorials use:
call_to_function + ret addr + arguments
For example I understand that if I want to execute system function from libc I can use the following scheme:
system_address(that overwrite eip) + addrsssOf_exit_function + arguments
What I didn't understand is why we use this order if before calling a function the arguments need to be already on the stack.
If I overwrite the
eip the next instruction called is system but we don't have already the arguments, right? What's I'm missing?