Hello, everyone, welcome to our second video of our Pinery exploitation series.
In this video, we will take a look at the effect of pushing destruction when our stock and the E.S.P
register.
Let's let's put a break point in our main function.
In our main function, we can see a push in instruction at main three, plus three four.
Let's examine the E.S.P value before and after this instruction.
Going to use step by first, step by step in one instruction.
So I said the program, it's easier just to set a breakpoint here and to continue.
OK, now we are here on this structure, LBA or lowed effective address.
We don't need to know this from now.
We just need to reach this new structure.
The push will step in.
OK.
At this instruction before we executed our strike points to zero X, BFX F, F, F, six C for now,
let's step in one instruction.
So after we pushed the value that was stored in index register on the stack, our E.S.P points to that
value at this moment here, which is emeritus of the Hello World.
Now, let's take a look at the address of Espie itself, not the value on this stack.
This is the actual address of USP FICO scroll up a little bit.
It was six o four, right?
Like Beef B, five, six or four.
But when we stepped in one instruction and then we pushed one value on the stack.
Now the address of VSP is six six zero zero.
Right.
What really happened is four bytes was subtracted from this address here.
It was six 04, but here it's six zero zero.
So we subtracted four from the the hex address of the first one because we stack grows it nodes downward
towards zero.
Right.
We really mentioned this before.
So it's the same thing with the pop instruction, an example, example of Poppy X, the poppy X and
obstruction will simply take the value at the top of the stack and put it in here x register, then
add four to the value VSP.
So it's actually the opposite of what we what we just did when we used push and then a register or a
hex value, we subtracted four from the stack because we're moving downwards, we're actually growing
our stack.
But when we popped, we're doing the opposite.
We are taking a value off the stack and we're moving upward, not downward.
That's why we had to add four, not to subtract four.
And when I say removing a value from the stack, we're not actually removing it.
It's still the data still in memory.
But we are just adjusting where the ASP is pointing at.
What else we should know?
Well, something very important we need to know about is how the function is being called.
When we call a function in our program, the program will go to the function and executed, execute
everything there.
Then when it's done, it has to go back to wherever called the function and continue from there again.
Right.
Let's take a look at a simple C program.
In this program, you know, our main function here, which is the color function, we will call my
funk, this one.
And Popson, my funk is finished executing everything it has to return to the address of the next instruction,
which is the printf in me not here, it will return to the next one.
Let's see a practical example in GDP.
We are now inside our main function in GDB, but we haven't called our mic or my funk function yet in
this line.
Let's take a look at what is being pushed on this tack when it's called, I'm going to set a breakpoint.
At this address, so because I want my program to stop here and then I will continue.
Remember, when we call my funk, we need to return back to the next instruction, which is sub E.S.P
06, see it has Addazio 06, Forry 11, year three.
Let's examine the value of the stack first, which also you can see here.
Step one instruction.
See what happened?
He examined the stack again, it points to the memory letters of the instruction that we just talked
about.
You go up a little bit.
This one.
So now we are inside my funk, once we are done executing everything, we have to return back to the
next instruction in the main function, which is just one.
This is the same thing with every function.
Whenever we call a function, we have to return to push the return address on the set, the same return.
So we need to go back to when we're done executing everything inside this function.
In the next video, we will take a look at how arguments are passed to the function along with the local
variables inside that function.
Thank you for watching and see you in the next one.