Buffer Overflows

From: <luck____at_hotmail.com>
Date: 29 Mar 2004 20:00:56 -0000

('binary' encoding is not supported, stored as-is) Hi hope someone could help me with a question I have. Why do many buffer overflow exploits use the %esp before the program has run as the return address? If im not wrong then the idea is to return into the buffer but the %esp before the program is run becomes %ebp during program execution and this is after the buffer in the stack? Would it not be better to return to (%esp before) - (length of buffer) which should place you at the start of the buffer assuming buffer is the first local variable to be declared (stack grows to lower addresses) This is really confusing me after I thought I had got my head round it.

Many Thanks
Received on Mar 29 2004