4.8 实战：栈溢出攻击示例
二进制方式打开
vi -b xxx
十六进制查看
%！ xxd %！ xxd -r 退出
查看函数的地址
readelf -s xxx.out |grep xxx
代码
#include<stdio.h>
void shellcode(void)
{
printf("virus run success!\n");
while(1);
}
int f(int argc
, char *argv
[])
{
int a
[4];
int tmp
;
FILE
*fp
;
tmp
= a
[4];
fp
= fopen(argv
[1],"r+");
if(fp
==NULL)
{
printf("open virus.bin failed!\n");
return -1;
}
fread(a
,4,9,fp
);
a
[4] = tmp
;
fclose(fp
);
}
int main(int argc
, char * argv
[])
{
f(argc
,argv
);
printf("hello world!\n");
return 0;
}
