作者:alert7 alert7@netguard.com.cn
★★ 三 高级篇
测试环境 redhat 6.2 glibc 2.1.3
★ 3.1 演示一
/* e1.c *
/* specially crafted to feed your brain by gera@core-sdi.com */
/* jumpy vfprintf, Batman! */
int main(int argv,char **argc) {
/* Can you do it changing the stack? */
/* Can you do it without changing it? */
printf(argc[1]);
while(1);
}
请参考拙作利用格式化串覆盖*printf()系列函数本身的返回地址
★ 3.2 演示二
/* e2.c *
/* s...[ 查看全文 ]