Skip to main content
1 of 2
Ben
  • 2.1k
  • 10
  • 17

Just a rough description for now as I don't have much time. The general idea is to determine the address of the target function as well as the exact position of the return address on your stack.

If you want to overwrite the return address you first need to find the correct position. To do so you will probably want to debug the program, set a breakpoint to the last possible step in your main function and watch re registers change by stepping single instructions from there. A brief hint: If you open the program and subsequently put a 1 Byte longer string into it every time it launches: you can watch it crash at some point. Assuming there is no stack canary or shadow stack or whatsoever you will have found your target address. You could (while debugging it) e.g. feed it a lot of 'A's and watch for 0x41 in your Debugger.

Next thing is to determine the address of your target function. Its pretty straight forward, you can e.g. try info symbol with info address. After that it all comes down to (in the easiest case) writing garbage (e.g. 'A') on the stack until you reach the adress of the RIP (Return Instruction Pointer) and then write the new adress you want into it.

Also do read a little about EIP/RIP, and Stack Overflow on wikipedia and others.

Cheers

Ben
  • 2.1k
  • 10
  • 17