title: The art of exploitation - exploit_notesearch.c
body: <p>i've got a question regarding the exploit_notesearch program.</p>
  
  <p>This program is only used to create a command string we finally call with the system() function to exploit the notesearch program that contains a buffer overflow vulnerability.
  The commandstr looks like this:
  <strong>./notesearch Nop-block|shellcode|repeated ret(will jump in nop block).</strong></p>
  
  <p>Now the actual question:
  The ret-adress is calculated in the exploit_notesearch program by the line:</p>
  
  <p>ret = (unsigned int) &amp;i-offset;</p>
  
  <p>So why can we use the address of the <strong>i-variable</strong> that is quite at the bottom of the <strong>main-stackframe of the exploit_notesearch</strong> program to calculate the <strong>ret address</strong> that will be saved in an overflowing buffer in the notesearch program itself ,so <strong>in an completely different stackframe</strong>, and has to contain an address in the nop block(which is in the same buffer).</p>