Getting the return address

Please support our C advertiser: Programming Forums - DaniWeb Sister Site
Reply

Join Date: Dec 2007
Posts: 113
Reputation: abhi_elementx is an unknown quantity at this point 
Solved Threads: 6
abhi_elementx's Avatar
abhi_elementx abhi_elementx is offline Offline
Junior Poster

Getting the return address

 
0
  #1
Jul 31st, 2009
Hello all.
I want to find the return address where execution should jump after returning from a function.
Say this is my code:
  1. void foo(){
  2. }
  3. int main(){
  4. foo();
  5. printf("After foo..");
  6. return 0;
  7. }

After foo() returns, how to find the rturn address where control will be passed?

Thank you....
PEACE !
Reply With Quote Quick reply to this message  
Join Date: Dec 2005
Posts: 5,850
Reputation: Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute 
Solved Threads: 749
Team Colleague
Salem's Avatar
Salem Salem is offline Offline
Void main'ers are DOOMed

Re: Getting the return address

 
0
  #2
Jul 31st, 2009
First, this is HIGHLY dependent on your current implementation. Change anything at all, and it might break.
It also means you need to tell us exactly what you have if you ever hope of a useful answer.

Second, why do you need to know, and what are you going to use the answer for (there's probably a better way).
Reply With Quote Quick reply to this message  
Join Date: Dec 2007
Posts: 113
Reputation: abhi_elementx is an unknown quantity at this point 
Solved Threads: 6
abhi_elementx's Avatar
abhi_elementx abhi_elementx is offline Offline
Junior Poster

Re: Getting the return address

 
0
  #3
Jul 31st, 2009
Alright then.
I m trying to smash the stack.
I am trying to modify the return address so that i divert the execution elsewhere.
This is my code :
  1. #include<stdio.h>
  2.  
  3. void function() {
  4. char buffer1[5];
  5. buffer1[0] = 'Z';
  6. char *ret = &buffer1[0];
  7. printf("\nbuffer1 is pointing at : %p", &buffer1);
  8. printf("\nret is pointing at address : %p and contains: %c",ret, *ret);
  9. ret = buffer1 + 8;//point to where return address is stored..hope this is correct
  10. printf("\nret is now pointing at address: %p",ret);
  11.  
  12. (*ret) += 8;//modify return address
  13.  
  14. }
  15.  
  16. int main() {
  17. int x;
  18. x = 0;
  19. function();
  20. x = 5;//we are skipping the execution of this assignment....
  21. printf("\nx = %d\n",x);//shud print 0
  22. return 0;
  23. }

heres the op:
  1. buffer1 is pointing at : 0xbf85bd4f
  2. ret is pointing at address : 0xbf85bd4f and contains: Z
  3. ret is now pointing at address: 0xbf85bd57
  4. x = 5
PEACE !
Reply With Quote Quick reply to this message  
Join Date: Dec 2007
Posts: 113
Reputation: abhi_elementx is an unknown quantity at this point 
Solved Threads: 6
abhi_elementx's Avatar
abhi_elementx abhi_elementx is offline Offline
Junior Poster

Re: Getting the return address

 
0
  #4
Jul 31st, 2009
oh! and i am usng gcc on ubuntu
PEACE !
Reply With Quote Quick reply to this message  
Join Date: Dec 2005
Posts: 5,850
Reputation: Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute Salem has a reputation beyond repute 
Solved Threads: 749
Team Colleague
Salem's Avatar
Salem Salem is offline Offline
Void main'ers are DOOMed

Re: Getting the return address

 
0
  #5
Jul 31st, 2009
Good luck with that
Reply With Quote Quick reply to this message  
Join Date: Dec 2008
Posts: 109
Reputation: winrawr is an unknown quantity at this point 
Solved Threads: 1
winrawr's Avatar
winrawr winrawr is offline Offline
Junior Poster

Re: Getting the return address

 
0
  #6
Aug 3rd, 2009
You will have to know how a stack frame is implemented on your system. I don't know if it is the same for all (or most) x86 systems, but from looking at this article on wikipedia it looks like it could be this:

  1. +==========================+-+
  2. | locals for function() | |
  3. +==========================+ |
  4. | return address | --> stack frame for function()
  5. +==========================+ |
  6. | parameters for function | |
  7. +==========================+-+

I did some toying around with C, and came up with this:

  1. #include<stdio.h>
  2.  
  3. void somefunct();
  4. void anotherfunct();
  5.  
  6. int main(){
  7.  
  8. somefunct();
  9.  
  10. printf("returned to main!\n");
  11.  
  12. return 0;
  13.  
  14. }
  15.  
  16. void somefunct(){
  17.  
  18. int *ptr = (int*)&ptr + 2;
  19. *ptr = (int)&anotherfunct;
  20.  
  21. }
  22.  
  23. void anotherfunct(){
  24.  
  25. printf("I win!\n\n");
  26.  
  27. }

this prints the output:

  1. ~/c/t $ ./retaddr
  2. I win!
  3.  
  4. Segmentation Fault
  5. ~/c/t $

The segmentation fault is because the stack is set up to return to main, and then return to the system once main completes. But since the return address is bashed to returned to yet another function, that function get's main's call stack. I have no idea what this does, but I'm assuming it is bad.

I had to play with the magic number (which turned out to be 2) for a bit, but I'm not exactly sure about why 2. I could play with it more and find out just how the stack frame looks, but I'll leave that up to you.

For fun, compile my code on your machine and see if you get identical output. Try it on a windows box. The behavior of this sort of thing depends heavily on the compiler and system.

I would play with this more but it's 2AM and time to get some rest.
Last edited by winrawr; Aug 3rd, 2009 at 5:16 am.
I wake up! And my mind's out, never again will I sell out. Converting vegetarians.
Into the midnight giving it to you, I don't know it just feels right.
This is the time of the revolution, Cooking the next step.
Converting vegetarians, minding the gap since 1996
Reply With Quote Quick reply to this message  
Join Date: Oct 2007
Posts: 1,951
Reputation: Duoas has much to be proud of Duoas has much to be proud of Duoas has much to be proud of Duoas has much to be proud of Duoas has much to be proud of Duoas has much to be proud of Duoas has much to be proud of Duoas has much to be proud of 
Solved Threads: 214
Featured Poster
Duoas's Avatar
Duoas Duoas is offline Offline
Posting Virtuoso

Re: Getting the return address

 
0
  #7
Aug 3rd, 2009
Check out the <csetjmp> library.

Don't mess with the stack. Otherwise you invite death.
Reply With Quote Quick reply to this message  
Reply

This thread is more than three months old.
Perhaps start a new thread instead?
Message:


Thread Tools Search this Thread



About Us | Contact Us | Advertise | DaniWeb | Acceptable Use Policy | RSS Feed

©2003 - 2009 DaniWeb® LLC