Bug Hunter Diary

eip 0x43434343 0x43434343eflags 0x10246 [ PF ZF IF RF ]cs 0x73 115ss 0x7b 123ds 0x7b 123es 0x7b 123fs 0x0 0gs 0x33 51I gained control over the instruction pointer (see the EIP register),as the return address was successfully overwritten with the fourCs supplied from the user input (hexadecimal value of the four Cs:0x43434343).Example: Stack Buffer Overflow Under WindowsI compiled the vulnerable program from Listing A-1 without securitycookie (/GS) support under Windows Vista SP2 (see Section C.1):C:\Users\tk\BHD>cl /nologo /GS- stackoverflow.cstackoverflow.cThen, I started the program in the debugger (see Section B.2 formore information about WinDbg) while supplying the same inputdata as in the Linux example above.As Figure A-2 shows, I got the same result as under Linux: controlover the instruction pointer (see the EIP register).Figure A-2: Stack buffer overflow under Windows (WinDbg output)152 Appendix A