Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I am doing a reverse homework. see the following pictures:
as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8).
once called push touch3, the "saved rip" is at 0x5561dca0, which is also equal to new rsp(0x5561dca0).
My question is, why push instruction changed the "saved rip" address.
Mainly, this is because the program did enough pop previously to get rsp just in front the saved rip. Then, a simple push will overwrite the saved rip.
As you can notice on the first picture, your saved rip is at 0x5561dca8 and, your rsp as well. Therefore, a push operation will store the address of the touch3 function as return address of the stack-frame.
Nothing really difficult here.
