title: How to write a buffer-overflow exploit in GCC,windows XP,x86?
body: <pre><code>void function(int a, int b, int c) {
     char buffer1[5];
     char buffer2[10];
     int *ret;
  
     ret = buffer1 + 12;
     (*ret) += 8;//why is it 8??
  }
  
  void main() {
    int x;
  
    x = 0;
    function(1,2,3);
    x = 1;
    printf("%d\n",x);
  }
  </code></pre>
  
  <p>The above demo is from here:</p>
  
  <p><a href="http://insecure.org/stf/smashstack.html" rel="noreferrer">http://insecure.org/stf/smashstack.html</a></p>
  
  <p>But it's not working here:</p>
  
  <pre><code>D:\test&gt;gcc -Wall -Wextra hw.cpp &amp;&amp; a.exe
  hw.cpp: In function `void function(int, int, int)':
  hw.cpp:6: warning: unused variable 'buffer2'
  hw.cpp: At global scope:
  hw.cpp:4: warning: unused parameter 'a'
  hw.cpp:4: warning: unused parameter 'b'
  hw.cpp:4: warning: unused parameter 'c'
  1
  </code></pre>
  
  <p>And I don't understand why it's 8 though the author thinks:</p>
  
  <blockquote>
    <p>A little math tells us the distance is
    8 bytes.</p>
  </blockquote>
  
  <p>My gdb dump as called:</p>
  
  <pre><code>Dump of assembler code for function main:
  0x004012ee &lt;main+0&gt;:    push   %ebp
  0x004012ef &lt;main+1&gt;:    mov    %esp,%ebp
  0x004012f1 &lt;main+3&gt;:    sub    $0x18,%esp
  0x004012f4 &lt;main+6&gt;:    and    $0xfffffff0,%esp
  0x004012f7 &lt;main+9&gt;:    mov    $0x0,%eax
  0x004012fc &lt;main+14&gt;:   add    $0xf,%eax
  0x004012ff &lt;main+17&gt;:   add    $0xf,%eax
  0x00401302 &lt;main+20&gt;:   shr    $0x4,%eax
  0x00401305 &lt;main+23&gt;:   shl    $0x4,%eax
  0x00401308 &lt;main+26&gt;:   mov    %eax,0xfffffff8(%ebp)
  0x0040130b &lt;main+29&gt;:   mov    0xfffffff8(%ebp),%eax
  0x0040130e &lt;main+32&gt;:   call   0x401b00 &lt;_alloca&gt;
  0x00401313 &lt;main+37&gt;:   call   0x4017b0 &lt;__main&gt;
  0x00401318 &lt;main+42&gt;:   movl   $0x0,0xfffffffc(%ebp)
  0x0040131f &lt;main+49&gt;:   movl   $0x3,0x8(%esp)
  0x00401327 &lt;main+57&gt;:   movl   $0x2,0x4(%esp)
  0x0040132f &lt;main+65&gt;:   movl   $0x1,(%esp)
  0x00401336 &lt;main+72&gt;:   call   0x4012d0 &lt;function&gt;
  0x0040133b &lt;main+77&gt;:   movl   $0x1,0xfffffffc(%ebp)
  0x00401342 &lt;main+84&gt;:   mov    0xfffffffc(%ebp),%eax
  0x00401345 &lt;main+87&gt;:   mov    %eax,0x4(%esp)
  0x00401349 &lt;main+91&gt;:   movl   $0x403000,(%esp)
  0x00401350 &lt;main+98&gt;:   call   0x401b60 &lt;printf&gt;
  0x00401355 &lt;main+103&gt;:  leave
  0x00401356 &lt;main+104&gt;:  ret
  0x00401357 &lt;main+105&gt;:  nop
  0x00401358 &lt;main+106&gt;:  add    %al,(%eax)
  0x0040135a &lt;main+108&gt;:  add    %al,(%eax)
  0x0040135c &lt;main+110&gt;:  add    %al,(%eax)
  0x0040135e &lt;main+112&gt;:  add    %al,(%eax)
  End of assembler dump.
  
  Dump of assembler code for function function:
  0x004012d0 &lt;function+0&gt;:        push   %ebp
  0x004012d1 &lt;function+1&gt;:        mov    %esp,%ebp
  0x004012d3 &lt;function+3&gt;:        sub    $0x38,%esp
  0x004012d6 &lt;function+6&gt;:        lea    0xffffffe8(%ebp),%eax
  0x004012d9 &lt;function+9&gt;:        add    $0xc,%eax
  0x004012dc &lt;function+12&gt;:       mov    %eax,0xffffffd4(%ebp)
  0x004012df &lt;function+15&gt;:       mov    0xffffffd4(%ebp),%edx
  0x004012e2 &lt;function+18&gt;:       mov    0xffffffd4(%ebp),%eax
  0x004012e5 &lt;function+21&gt;:       movzbl (%eax),%eax
  0x004012e8 &lt;function+24&gt;:       add    $0x5,%al
  0x004012ea &lt;function+26&gt;:       mov    %al,(%edx)
  0x004012ec &lt;function+28&gt;:       leave
  0x004012ed &lt;function+29&gt;:       ret
  </code></pre>
  
  <p>In my case the distance should be  -  = 5,right?But it seems not working..</p>
  
  <p>Why <code>function</code> needs <strong>56</strong> bytes for local variables?( <code>sub    $0x38,%esp</code> )</p>