Snorflake

Return address modification

Sep 30th, 2015
218
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 1.04 KB | None | 0 0
  1. //This is what I learnt today.
  2. //Credits: http://stackoverflow.com/questions/10264512/asssembly-base-pointer-and-stack-pointer
  3. #include <Windows.h>
  4. #include <iostream>
  5.  
  6. int inc = 0;
  7. int timesrun = 555;
  8. /*
  9. What it looks like after the stack frame is setup
  10. +-------------+
  11. | Parameter 2 | <-- [ebp + 12]
  12. +-------------+
  13. | Parameter 1 | <-- [ebp + 8]
  14. +-------------+
  15. | Return Addr | <-- [ebp + 4]
  16. +-------------+
  17. | saved ebp   | <-- ebp
  18. +-------------+ <-- esp
  19. */
  20. void twoargs()
  21. {
  22.     void* basePtr;
  23.     __asm mov basePtr, ebp;
  24.     /*If you make this a pointer and dereference it, it'll make int main() run |timesrun| amount of times*/
  25.     DWORD* retnaddr = (DWORD*)((DWORD)basePtr+ 0x4); //Return address of twoargs()
  26.     //Example: DWORD* retnaddr = (DWORD*)(*(DWORD*)basePtr+ 0x4); // Return address of main()
  27.     if (timesrun > 1)
  28.     {
  29.         timesrun -= 1;
  30.         *retnaddr -= 0x5; //Move it back to ebp - 0x1
  31.     }
  32.     inc++;
  33. }
  34.  
  35. int main()
  36. {
  37.     int expected = timesrun;
  38.     twoargs();
  39.     printf("%i\nexpected output: %i", inc, expected);
  40.     getchar();
  41.     return 0;
  42. }
Advertisement
Add Comment
Please, Sign In to add comment