无法利用堆栈溢出

Question

I'm learning buffer overflows, and I have a problem with exploiting a stack based buffer overflow. Here is my program:

#include <stdio.h>

void func(){
    printf("asd");
}
main(){
    char buf[10];
    scanf("%s", &buf);
}

I'm overwriting first 14 bytes with A's(the buffer and the old EIP address). My goal is to execute the func function, or to change the EIP with it's address. But I'm always getting illegal instruction. I have check the HEX address of the function; I have written them in reverse order and they are correct.

Answer 1

You will have to look at the compiled code in assembler eg your main() may look like:

    char buf[10];
    scanf("%s", &buf);
00D7B938  mov         esi,esp  
00D7B93A  lea         eax,[ebp-14h]  
00D7B93D  push        eax  
00D7B93E  push        offset string "%s" (0D818D4h)  
00D7B943  call        dword ptr [__imp__scanf (0D89684h)]  

You'll have to debug to see what is actually on the stack at this point, eg if you are compiling in debug, it is highly likely there's a lot more on the stack than you may think !