Ad:

C Discussion Thread
Unsolved
Views: 1735

Jul 31st, 2009

Getting the return address

Expand Post »

Hello all.
I want to find the return address where execution should jump after returning from a function.
Say this is my code:

C Syntax (Toggle Plain Text)
void foo(){
}
int main(){
 foo();
printf("After foo..");
return 0;
}
void foo(){
}
int main(){
 foo();
printf("After foo..");
return 0;
}

After foo() returns, how to find the rturn address where control will be passed?

Thank you....

Similar Threads

abhi_elementx

Reputation Points: 11

Solved Threads: 7

Junior Poster

Offline

118 posts
since Dec 2007

Permalink

Jul 31st, 2009

Re: Getting the return address

First, this is HIGHLY dependent on your current implementation. Change anything at all, and it might break.
It also means you need to tell us exactly what you have if you ever hope of a useful answer.

Second, why do you need to know, and what are you going to use the answer for (there's probably a better way).

Salem

Team Colleague

Reputation Points: 5862

Solved Threads: 950

Posting Sage

Offline

7,164 posts
since Dec 2005

Permalink

Jul 31st, 2009

Re: Getting the return address

Alright then.
I m trying to smash the stack.
I am trying to modify the return address so that i divert the execution elsewhere.
This is my code :

C Syntax (Toggle Plain Text)
#include<stdio.h>
 
void function() {
   char buffer1[5];
   buffer1[0] = 'Z'; 	
   char *ret = &buffer1[0];
   printf("\nbuffer1 is pointing at : %p", &buffer1); 	
   printf("\nret is pointing at address : %p and contains: %c",ret, *ret);	
   ret = buffer1 + 8;//point to where return address is stored..hope this is correct
   printf("\nret is now pointing at address: %p",ret);
 
   (*ret) += 8;//modify return address 
 
}
 
int main() {
  int x;
  x = 0;
  function();
  x = 5;//we are skipping the execution of this assignment....
  printf("\nx = %d\n",x);//shud print 0
  return 0;
}
#include<stdio.h>

void function() {
   char buffer1[5];
   buffer1[0] = 'Z'; 	
   char *ret = &buffer1[0];
   printf("\nbuffer1 is pointing at : %p", &buffer1); 	
   printf("\nret is pointing at address : %p and contains: %c",ret, *ret);	
   ret = buffer1 + 8;//point to where return address is stored..hope this is correct
   printf("\nret is now pointing at address: %p",ret);
  
   (*ret) += 8;//modify return address 
  	
}

int main() {
  int x;
  x = 0;
  function();
  x = 5;//we are skipping the execution of this assignment....
  printf("\nx = %d\n",x);//shud print 0
  return 0;
}

heres the op:

C Syntax (Toggle Plain Text)

buffer1 is pointing at : 0xbf85bd4f
ret is pointing at address : 0xbf85bd4f and contains: Z
ret is now pointing at address: 0xbf85bd57
x = 5

abhi_elementx

Reputation Points: 11

Solved Threads: 7

Junior Poster

Offline

118 posts
since Dec 2007

Permalink

Jul 31st, 2009

Re: Getting the return address

oh! and i am usng gcc on ubuntu

abhi_elementx

Reputation Points: 11

Solved Threads: 7

Junior Poster

Offline

118 posts
since Dec 2007

Permalink

Jul 31st, 2009

Re: Getting the return address

Good luck with that

Salem

Team Colleague

Reputation Points: 5862

Solved Threads: 950

Posting Sage

Offline

7,164 posts
since Dec 2005

Permalink

Aug 3rd, 2009

Re: Getting the return address

You will have to know how a stack frame is implemented on your system. I don't know if it is the same for all (or most) x86 systems, but from looking at this article on wikipedia it looks like it could be this:

C Syntax (Toggle Plain Text)
+==========================+-+
| locals for function()    | |
+==========================+ |
| return address           |  -->  stack frame for function()
+==========================+ |
| parameters for function  | |
+==========================+-+
+==========================+-+
| locals for function()    | |
+==========================+ |
| return address           |  -->  stack frame for function()
+==========================+ |
| parameters for function  | |
+==========================+-+

I did some toying around with C, and came up with this:

C Syntax (Toggle Plain Text)
#include<stdio.h>
 
void somefunct();
void anotherfunct();
 
int main(){
 
    somefunct();
 
    printf("returned to main!\n");
 
    return 0;
 
}
 
void somefunct(){
 
    int *ptr = (int*)&ptr + 2;
    *ptr = (int)&anotherfunct;
 
}
 
void anotherfunct(){
 
    printf("I win!\n\n");
 
}
#include<stdio.h>

void somefunct();
void anotherfunct();

int main(){
    
    somefunct();

    printf("returned to main!\n");

    return 0;

}

void somefunct(){

    int *ptr = (int*)&ptr + 2;
    *ptr = (int)&anotherfunct;

}

void anotherfunct(){

    printf("I win!\n\n");

}

this prints the output:

C Syntax (Toggle Plain Text)

~/c/t $ ./retaddr
I win!
 
Segmentation Fault
~/c/t $

The segmentation fault is because the stack is set up to return to main, and then return to the system once main completes. But since the return address is bashed to returned to yet another function, that function get's main's call stack. I have no idea what this does, but I'm assuming it is bad.

I had to play with the magic number (which turned out to be 2) for a bit, but I'm not exactly sure about why 2. I could play with it more and find out just how the stack frame looks, but I'll leave that up to you.

For fun, compile my code on your machine and see if you get identical output. Try it on a windows box. The behavior of this sort of thing depends heavily on the compiler and system.

I would play with this more but it's 2AM and time to get some rest.

Last edited by winrawr; Aug 3rd, 2009 at 5:16 am.

winrawr

Reputation Points: 19

Solved Threads: 1

Junior Poster

Offline

110 posts
since Dec 2008

Permalink

Aug 3rd, 2009

Re: Getting the return address

Check out the <csetjmp> library.

Don't mess with the stack. Otherwise you invite death.

Duoas

Featured Poster

Reputation Points: 1140

Solved Threads: 229

Postaholic

Offline

2,039 posts
since Oct 2007

Permalink

Sep 28th, 2010

Re: Getting the return address

Your function should be like this

C Syntax (Toggle Plain Text)
void function() {
   int a;
   *(&a+2)+=0x07; 	
}
void function() {
   int a;
   *(&a+2)+=0x07; 	
}

Last edited by arajak; Sep 28th, 2010 at 4:50 pm.

arajak

Reputation Points: 10

Solved Threads: 0

Newbie Poster

Offline

1 posts
since Sep 2010

Permalink

Sep 29th, 2010

Re: Getting the return address

Yes I know the thread is almost a year old but this seemed like an interesting questions and there was no follow up

@winrawr I ran your code in a Windows machine and it worked. No seg fault no nothing

abhimanipal

Reputation Points: 114

Solved Threads: 104

Master Poster

Offline

736 posts
since Dec 2009

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.

Previous Thread in C Forum Timeline: Shift-Add vs Multiplication // Bit-Wise vs. Logical Operators

Next Thread in C Forum Timeline: String to function name

DaniWeb Message

Cancel Changes

User Name
Password