stack frame analysis of programs in Linux and modifying function addresses

Source: Internet
Author: User

Here's a piece of code:
#include <stdio.h> #include <unistd.h> #include <stdlib.h>void fun () {printf ("I am the Evil func\n"); Exit (1);}    int fun1 (int a,int b) {int *p=&a;    p--;    *p=fun;    int C=0XCCCC; return c;} int main () {printf ("Begin run..    \ n ");    int a=0xaaaa;    int b=0xbbbb;    Fun1 (A, b);    printf ("Right End");    return 0; }

Execution results under Linux:

Main call FUN1 Call fun---exit exit

For the problem with this result:

Obviously did not call the fun function, why do the fun function, the function is how to jump?

How does the stack frame save the information and return it?

Analysis Reason:

View important stack segments in assembly code

650) this.width=650; "src=" Http://s1.51cto.com/wyfs02/M02/83/17/wKiom1dqdS7ChdVmAACpe1R_wTY604.png "title=" screen Shot 2016-06-22 at 19.22.39.png "alt=" Wkiom1dqds7chdvmaacpe1r_wty604.png "/>

650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M02/83/17/wKioL1dqeFuCMcU4AAHetPh8lMg950.png "title=" screen Shot 2016-06-22 at 19.36.24.png "alt=" Wkiol1dqefucmcu4aahetph8lmg950.png "/>

Simple stack frame diagram


650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M02/83/17/wKioL1dqfS_A-W_RAAEVPe2-GLs083.png "title=" screen Shot 2016-06-22 at 19.57.10.png "alt=" Wkiol1dqfs_a-w_raaevpe2-gls083.png "/>

The following program accesses the value of the variable y through a pointer, not the variable name y

#include <stdio.h>int fun (int x,int y) {int *p = x;    p--; return *p;}    int main () {int x=1;    int y=2;    int Ret=fun (x, y);    printf ("Y's value is%d\n" ret); return 0;}

The principle is that after p-->x,p--, p points to Y

At this point *p is accessing the value of Y.

This article from "Momo is spicy moe" blog, please be sure to keep this source http://momo462.blog.51cto.com/10138434/1791894

stack frame analysis of programs in Linux and modifying function addresses

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.