1

I am doing a reverse homework. see the following pictures:

enter image description here

as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8).

once called push touch3, the "saved rip" is at 0x5561dca0, which is also equal to new rsp(0x5561dca0).

My question is, why push instruction changed the "saved rip" address.

enter image description here

  • Can you please share the assembly code pointing your query in your question? – Biswapriyo Feb 25 at 13:32
  • actually, this is a lab (attack lab) from the book csapp, which can be found in cmu csapp official website. this is code for phase-3, if you are interested in this problem, you can download it and have a try. – JinLing Feb 25 at 13:34
2

Mainly, this is because the program did enough pop previously to get rsp just in front the saved rip. Then, a simple push will overwrite the saved rip.

As you can notice on the first picture, your saved rip is at 0x5561dca8 and, your rsp as well. Therefore, a push operation will store the address of the touch3 function as return address of the stack-frame.

Nothing really difficult here.

  • 1
    Thanks to your answer I now think I have understood the question. Didn't manage by reading the question alone. – 0xC0000022L Mar 5 at 21:11
  • Ah ah, I mainly guessed my way out for this one. So, do not feel guilty, I have just been lucky to get it right this time! ;-) – perror Mar 6 at 8:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.