Hello, everyone, welcome to our Third Day, you are Binary Exploitation series.
Let's take a look at another example of function with an argument past, which is the same concept.
But when we pass an argument to a function, this argument will be pushed on the stack first and then
the return address to go to.
So let's take a look at this program.
We have two variables and our main function, and we have one function called my func.
And then we will call this function from our main program, we're passing our two variables, bar one
of our two, and then we will come here.
We will have two variables and set our function to local variables, will print something to the screen.
And then, of course, we have to return back to the next instruction after the colon one, which is
a print of this line.
Keep in mind that the return address, when the function is done, executing it, will be in the IP
register.
As we said earlier, it contains the very address of the next construction.
So if we are able to override the IP register with a memory address of our cell code that we will create
later, it will go there and execute it for us.
Right.
In this picture, this is the main frame from the main function.
We haven't called anything yet.
But once we called them my funk.
We are creating a new static frame and pushing the values of our one anvar two on the stack, which
in fact is X and Y at the receiving function.
Keep in mind that when running a programming assembly, the order of the argument will be reversed.
So if you have X first and then Y, then others can function and then you need to push Y first and then
X.
And then of course the returning address, which is the next instruction after decoding one print f
don calling.
Also, every time we call a function, there are three instructions to take place.
First, since a new tack will be created, we don't want to lose our pointer to the old stack, right?
Then a push, BP instruction is used now when we pushed BP onto the stack, EBP points to the to the
top of the previous static frame.
So the address that BP was pointing at here will be pushed all the way here because we don't want to
lose track of our old stack.
Right.
And of course, we have ESP pointing here since we really pushed a new ATRs here.
Let's take a look at the second instruction.
Which is Move SBP E.S.P, so we're actually moving the value of E.S.P to SBP, not the value of opportunities.
This is the Cantell Syntex.
The source is USP and the destination is EDP.
So by making this construction, we are actually making ESPN, SBP, both of them pointing at the top
of the stack.
And keep in mind that we have local variables in our function.
Right?
If we go back here, we have A and B, so we need eight bytes because every each integer is only four
bytes.
So we need eight bytes for a space on the stack for our variables.
So that's when we come to our third, um, instruction sub E.S.P eight.
So now we just sort of pointing here will go here because we need to make space for our two local variables,
eight bytes.
So just to recap, we pushed our arguments first.
Why an X or Vah one or two, and then our return address from the main function and then our old base
pointer.
And then we we make we made a space for our two variables and B, which is eight bytes.
Right.
Keep that in mind because we will need it later when we do our binary exploitation and we need to know
where our return address because we need to override this return address for our binary exploitation
to work.
That said, for this video, thank you and see you in the next one.