format string exploitation, how can I retrieve saved istruction pointer?

Question

I have a problem with my exploit (doing for exercise). The string to pass to my vulnerable program is ready except for the target address where I want to write, of course it is the current saved $eip.

How can I retrieve it? The answer seems to be easy, by debugging of course, stop the execution and see the address printing the stack. Ok let's assume now that I retrieved it, the problem is that I launch an executable not compiled with the -g option, so no way to set breakpoints... so How can I do that?

Note that, the two stack (one of the file compiled with -g and the one without it) are different!! different stack, so different $eip address (and also value).

Answer 1

for future readings, I finally made it! I just wrote down a script to cycle over all possibile address ( in restricted range to raise down the time effort) and I found it ;) Tunarock 1 ASLR 0 – Tunarock