title: I can't modify RIP register on 64-bit linux
body: <p>I'm trying to learn about stack overflow but all that i read was about 32-bit. My processor is 64-bit and i am having the following problem:</p>
  
  <p>C code:</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  void return_input (void)
  { 
  char array[30]; 
  gets (array); 
  printf("%s\n", array); 
  }
  int main() 
  { 
  return_input(); 
  return 0; 
  </code></pre>
  
  <p>}</p>
  
  <p>GDB disas main:</p>
  
  <pre><code>Dump of assembler code for function main:
     0x000000000040055f &lt;+0&gt;: push   %rbp
     0x0000000000400560 &lt;+1&gt;: mov    %rsp,%rbp
     0x0000000000400563 &lt;+4&gt;: callq  0x40053d &lt;return_input&gt;
     0x0000000000400568 &lt;+9&gt;: mov    $0x0,%eax
     0x000000000040056d &lt;+14&gt;:    pop    %rbp
     0x000000000040056e &lt;+15&gt;:    retq   
  End of assembler dump.
  </code></pre>
  
  <p>GDB disas return_input:</p>
  
  <pre><code>   Dump of assembler code for function return_input:
     0x000000000040053d &lt;+0&gt;: push   %rbp
     0x000000000040053e &lt;+1&gt;: mov    %rsp,%rbp
     0x0000000000400541 &lt;+4&gt;: sub    $0x20,%rsp
     0x0000000000400545 &lt;+8&gt;: lea    -0x20(%rbp),%rax
     0x0000000000400549 &lt;+12&gt;:    mov    %rax,%rdi
     0x000000000040054c &lt;+15&gt;:    callq  0x400440 &lt;gets@plt&gt;
     0x0000000000400551 &lt;+20&gt;:    lea    -0x20(%rbp),%rax
     0x0000000000400555 &lt;+24&gt;:    mov    %rax,%rdi
     0x0000000000400558 &lt;+27&gt;:    callq  0x400410 &lt;puts@plt&gt;
     0x000000000040055d &lt;+32&gt;:    leaveq 
     0x000000000040055e &lt;+33&gt;:    retq 
  </code></pre>
  
  <p>Compile instructions:</p>
  
  <pre><code>cc -mpreferred-stack-boundary=4 -ggdb overflow.c -o overflow
  or
  cc -mpreferred-stack-boundary=4 -ggdb -fno-stack-protector -z execstack overflow.c -o overflow
  </code></pre>
  
  <p>Well, i am trying to modify RIP to 0x0000000000400563, and make that the code ask two times for the input, but it dosnt work. </p>
  
  <p>I found that the code crash with an input of 40 caracters. So i tryied with the following input:</p>
  
  <pre><code>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x63\x05\x40\x00
  
  break *0x000000000040055
  
  (gdb) x/12x $rsp
  0x7fffffffe280: 0x41414141  0x41414141  0x41414141  0x41414141
  0x7fffffffe290: 0x41414141  0x41414141  0x41414141  0x41414141
  0x7fffffffe2a0: 0x41414141  0x41414141  0x3336785c  0x3530785c
  (gdb) 
  </code></pre>
  
  <p>Normal input without crashes:</p>
  
  <pre><code>AAAAAAAAAAAAAAAAAAAAAAAAA
  
  break *0x000000000040055
  
  (gdb) x/12x $rsp
  0x7fffffffe280: 0x41414141  0x41414141  0x41414141  0x41414141
  0x7fffffffe290: 0x41414141  0x41414141  0x00400041  0x00000000
  0x7fffffffe2a0: 0xffffe2b0  0x00007fff  0x00400568  0x00000000
  (gdb) 
  </code></pre>
  
  <p>As you can see, here the stack points to 0x00400568 but with the input for controll the RIP points to 0x3336785c. Why? I can't inject the address in the right way.</p>
  
  <p>Thank you for your time. I will really appreaciate any answer.</p>