Let's say I have a function (vuln) that has a local buffer with size of 0x20 bytes. In the beginning of this function, there is
Is that correct, that the stack looks like:
(0x20)...r4(0x4)...r5(0x4)...r6(0x4)...r7(0x4)...lr (for return address
...fp (previous frame pointer
0x4)... And then the stack frame of the caller function.
That means, if I want to jump to the function in the address
0xabcd, I need to put in the buffer
AA* 0x32 +
0x32 = buffer +r4-r7) .
Is that correct?the place of lr will be replaced but the place of fp stay correct?
Now, if I really will jump to address of 0xabcd. After this function (
0xabcd) will finish. The function will try to restore the fp and will crash because it's frame pointer of the vulnerable function.
Is that correct?