title: what's happened when process is attacked by "stack buffer overflow"?
body: <p>I'm a student learning computer security. Recently, I learned stack buffer overflow on c.<br />
  I understood its concepts and run sample codes written by c.</p>
  <pre><code>void main(){
      char buf[] = &quot;\xeb\x0b\x31\xc0\xb0\x0b\x31\xd2\x31\xc9\x5b\xcd\x80\xe8\xf0\xff\xff\xff/bin/sh\x0&quot;;
      int* p;
      p = (int*)&amp;p + 2;
      *p = (int)buf;
      return;
  }
  </code></pre>
  <p>Runtime Environment</p>
  <ul>
  <li>Architecture: i686</li>
  <li>OS: ubuntu 16.04 32bit</li>
  <li>Compiler: gcc</li>
  <li>Turn off ASLR(sysctl -w kernel.randomize_va_space=0)</li>
  <li>Options: gcc -z execstack -mpreferred-stack-boundary=2 -fno-stack-protector</li>
  </ul>
  <p>But I confuse what stack is saved and which memories are overlapped.<br />
  Above binary code, <code>&quot;\xeb\x0b\x31\xc0\xb0\x0b\x31\xd2\x31\xc9\x5b\xcd\x80\xe8\xf0\xff\xff\xff/bin/sh\x0&quot;</code>,
  the same assembly code is</p>
  <pre><code>.global main
  
  main:
      jmp strings
  
  start:
      xor %eax, %eax
      movb $0xb, %al
  
      xor %edx, %edx
      xor %ecx, %ecx
      
      popl %ebx
      int $0x80
  
  strings:
      call start
      .string &quot;/bin/sh&quot;
  
  </code></pre>
  <p>means <code>execve(&quot;/bin/sh&quot;, NULL, NULL);</code>.<br />
  When buffer overflow occurs, the binaries are overlapped <strong>return addresses of main</strong> on stack. But, I'm understood to be that the stack stores data s.t local variables, previous frame pointers, and return address.<br />
  I think the above binaries are not data, actually instructions. If so, why is this valid? The stack stores instructions and executes one-by-one by popping them? Or I misunderstand something?<br />
  And if the stack stores instructions, how do previous stack frame pointers(<strong>fp</strong>) and return addresses(<strong>ra</strong>) work?<br />
  I learned that previous function's stack frame address is stored in <strong>fp</strong> and next instruction's address on code area is stored in <strong>ra</strong>. So, when called function is terminated, <strong>sp</strong> is popped and then <strong>ra</strong> does to restore previous function state and run next instruction. Is it correct? Or I misunderstand something?<br />
  I want to know really this..<br />
  Thank you for your help.</p>