title: Calculating return addr in stack from a buffer pointer
body: <p>I am trying to smash stack and trying to bring SHELL reading from below link:
  <a href="http://insecure.org/stf/smashstack.html" rel="nofollow">http://insecure.org/stf/smashstack.html</a>
  I am sending arglen neg and successlully smash the stack and code is giving segfault. But I cannot calculate the RET Address where I should put SHELL code that I have. So in buffer after that distance I shall put the SHELL code.</p>
  
  <pre><code>int foo(char* arg, short arglen)
  {
      char buffer[8];
      short maxlen = 8;
      int len;
      if (arglen &lt; maxlen)
      {
          len = strlen(arg);
          printf("arglen =%d, buf size =%d\n", arglen, len);
          strncpy(buffer, arg, len);
      }else
          printf("foo finished. Everything is normal.\n");
      return 0;
  }
  </code></pre>
  
  <p>The <code>info frame</code> O/P of above code is putting break point in strncpy:</p>
  
  <pre><code>(gdb) info frame
  Stack level 0, frame at 0xffffc740:
   eip = 0x804854a in foo (target.c:17); saved eip = 0x804864f
   called by frame at 0xff80cd13
   source language c.
   Arglist at 0xffffc738, args: arg=0xffffc750 "1\300Ph//shh/bin\211\343PS\211ᙰ\v̀", arglen=-32549
   Locals at 0xffffc738, Previous frame's sp is 0xffffc740
   Saved registers:
    ebp at 0xffffc738, eip at 0xffffc73c
  (gdb) 
  </code></pre>
  
  <p>How Can I calculate the return address from <code>buffer</code> address?</p>
  
  <p>[EDIT]</p>
  
  <pre><code>12345%n\x90\x90\x90\x90...\x90\x90SHELLCODE
  </code></pre>
  
  <p>Like this I want to put my buffer memory</p>