修改栈中函数调用返回地址，改变程序执行流程任务：修改栈中函数调用返回地址，改变程序执行流程在本例中，通过修改函数function调用返回地址，使程序跳过执行x=1的赋值语句，从而使输出结果为0为了实现这个目标，需要1.找到函数调用返回地址在栈中的位置 由于c程序中无法直接取得返回地址，本例中以buffer1地址为基址，通过计算其与返回地址在栈中地址的差值，得到返回地址（在栈中）的地址 对应程序中的7、8句 7 ret=buffer1+12; 8 (*ret)+=5;buffer1和返回地址通过gdb调试得到2 .计算所跳过指令与下一条指令的差值，这通过反汇编代码可以直接计算得出源程序 1 i#include 2 void function(int a,int b,int c) 3 4 char buffer15; 5 char buffer210; 6 int *ret; 7 ret=buffer1+12; 8 (*ret)+=5; 9 10 11 void main() 12 13 int x; 14 x=0; 15 function(1,2,3); 16 x=1; 17 printf(%dn,x); 18 编译：gcc -o e -g e.c调试：gdb e 反汇编 disassemble main 0x0804844e :push %ebp 0x0804844f :mov %esp,%ebp 0x08048451 :and $0xfffffff0,%esp 0x08048454 :sub $0x20,%esp 要跳过指令地址 0x08048457 :movl $0x0,0x1c(%esp) 0x0804845f :movl $0x3,0x8(%esp) 0x08048467 :movl $0x2,0x4(%esp) 0x0804846f :movl $0x1,(%esp) 0x08048476 :call 0x8048414 0x0804847b :movl $0x1,0x1c(%esp) 0x08048483 :mov $0x8048560,%eax 0x08048488 :mov 0x1c(%esp),%edx 0x0804848c :mov %edx,0x4(%esp) 0x08048490 :mov %eax,(%esp) 0x08048493 :call 0x8048338 0x08048498 :leave 0x08048499 :ret disassemble function: 0x08048414 :push %ebpBuffer1地址 ！ 0x08048415 :mov %esp,%ebp 0x08048417 :sub $0x28,%esp 0x0804841a :mov %gs:0x14,%eax 0x08048420 :mov %eax,-0xc(%ebp) 0x08048423 :xor %eax,%eax 0x08048425 :lea -0x21(%ebp),%eax 0x08048428 :add $0xc,%eax 0x0804842b :mov %eax,-0x1c(%ebp) 0x0804842e :mov -0x1c(%ebp),%eax 0x08048431 :mov (%eax),%eax 0x08048433 :lea 0x5(%eax),%edx 0x08048436 :mov -0x1c(%ebp),%eax 0x08048439 :mov %edx,(%eax) 0x0804843b :mov -0xc(%ebp),%eax 0x0804843e :xor %gs:0x14,%eax 0x08048445 :je 0x804844c 0x08048447 :call 0x8048348 0x0804844c :leave 0x0804844d :ret下面通过设置断点和单步调试的方法找到所需地址在x=0处设置断点 break 14运行 run寄存器情况：(gdb) info registerseax 0xbffff3e4-1073744924ecx 0x133a3a60322583136edx 0x11ebx 0x287ff42654196esp 0xbffff3100xbffff310ebp 0xbffff3380xbffff338esi 0x00edi 0x00eip 0x80484570x8048457 eflags 0x282 SF IF cs 0x73115ss 0x7b123ebpds 0x7b123es 0x7b123fs 0x00gs 0x3351栈的情况：0xbffff310:0x002883240x00287ff40x080484b00xbffff3380xbffff320:0x0015e9850x0011eb800x080484bb0x00287ff40xbffff330:0x080484b00x00000000下一条指令 (gdb) display/i $pc = 0x8048457 :movl $0x0,0x1c(%esp)继续执行(gdb) si15function(1,2,3);1: x/i $pc= 0x804845f :movl $0x3,0x8(%esp)看寄存器(gdb) info registerseax 0xbffff3e4-1073744924ecx 0x133a3a60322583136edx 0x11ebx 0x287ff42654196esp 0xbffff3100xbffff310ebp 0xbffff3380xbffff338esi 0x00edi 0x00eip 0x804845f0x804845f eflags 0x282 SF IF cs 0x73115ss 0x7b123ds 0x7b123es 0x7b123fs 0x00gs 0x3351栈(gdb) x/10x $esp0xbffff310:0x002883240x00287ff40x080484b00xbffff3380xbffff320:0x0015e9850x0011eb800x080484bb0x00000000X地址在这0xbffff330:0x080484b00x00000000继续执行下一条指令(gdb) si0x0804846715function(1,2,3);1: x/i $pc= 0x8048467 :movl $0x2,0x4(%esp)寄存器(gdb) info registerseax 0xbffff3e4-1073744924ecx 0x133a3a60322583136edx 0x11ebx 0x287ff42654196esp 0xbffff3100xbffff310ebp 0xbffff3380xbffff338esi 0x00edi 0x00eip 0x80484670x8048467 eflags 0x282 SF IF cs 0x73115ss 0x7b123ds 0x7b123es 0x7b123fs 0x00gs 0x3351栈(gdb) x/10x $esp0xbffff310:0x002883240x00287ff40x000000030xbffff3380xbffff320:0x0015e9850x0011eb800x080484bb0x000000000xbffff330:0x080484b00x00000000继续下一条指令(gdb) si0x0804846f15function(1,2,3);1: x/i $pc= 0x804846f :movl $0x1,(%esp)寄存器(gdb) info registerseax 0xbffff3e4-1073744924ecx 0x133a3a60322583136edx 0x11ebx 0x287ff426