Hack Security Pro.pdf - Index of

A few assembler notions
Let us see several essential assembler instruction:
call 0x8048344 : When a routine calls a subroutine, it does an instruction call, which then
jumps onto the address of the jump function in the .text section.
ret : When all the instructions of a subroutine have been executed, the program returns to the
address following the call on this subroutine. In this example, the call to the RET instruction at the
0x8048357 address will make the program jump to the address following the func call, that is
0x804836d. This instruction present at the end of eacj subroutine is actually a macro that successively
executed
pop %eip
jmp %eip
Registers
Registers, (eax, ebx, ecx, edx, eip, ebp, esp ...) have a size of 32 bits or 4 bytes on Linux/X86
platforms. Three of these are of a particular interest to us.
EIP (Instruction Pointer): In this register is saved the address where the program
must jump to in the .text at the output of a subroutine, that is during the call to
ret.
ESP (Stack pointer): This register always points to the end of the stack (we will talk
about this soon).
EBP When a new subroutine is called, new elements will be piled on top of the stack
and so the ESP will be modified. So we save the old value of ESP in EBP, in
order to re-attribute its previous value to the Stack Pointer during the call to RET.
Let us check the state of registers during the call to the func function in our previous example:
Stack level 0, frame at 0xb64950e8:
eip = 0x804834a in func; saved eip 0x804836d
called by frame at 0xb64950f8
Arglist at 0xb64950e8, args:
Locals at 0xb64950e8, Previous frame's sp in esp
Saved registers:
ebp at 0xb64950e8, eip at 0xb64950ec
We can see that the EIP saved is: saved eip 0x804836d, which is the expected address.
The Hackademy DMP -141/209- SYSDREAM