How to modify return address on Stack in C or Assembly

Javad Yousefi

As you know, when a subroutine calls, current PC (program counter) value stores in stack. I want to modify it inside the subroutine, like below. I want do this on Intel Core-i7 3632QM using gcc compiler.

void main()
{
     foo();
}
void foo()
{
     pop return address from stack;
     modify return address;
     push it to stack;
}
Jester

This is almost certainly an XY problem, you didn't say what you really want to do. Anyway, here is sample code that modifies the return address:

#include <stdio.h>
#include <stdlib.h>

void bar()
{
    puts("entered the bar ;)");
    exit(0);
}

void** search(void** addr, void* value) __attribute__((noinline));
void** search(void** addr, void* value)
{
    while(*addr != value) addr++;
    return addr;
}

void foo() __attribute__((noinline));
void foo()
{
    void** p = search((void**)&p, __builtin_return_address(0));
    *p = bar;
}

int main()
{
    foo();
    return 0;
}

See it in action.

Obviously foo must not be inlined for it to even have a return address, and I had to split out search into its own function for some obscure optimization issue whereby the compiler would otherwise remove the write to the return address. Searching for the return address like this makes it more tolerant of stack layout differences than if you just hardcoded some specific offset from a local variable.

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

From Dev

Return address prediction stack buffer vs stack-stored return address?

From Dev

C - modify the address of a pointer passed to a function

From Dev

How does assembly know where to return?

From Dev

How assembly accesses/stores variables on the stack

From Dev

How to get stack memory address of a string in visual studio 2010 C#

From Dev

Missing return address on stack

From Dev

Simple stack example, how to return if stack is empty?

From Dev

Modify the return address of a C function with buffer overflow vulnerability

From Dev

How to return the last element in stack

From Dev

GCC C and ARM Assembly Stack Cleanup

From Dev

What happens if i overwrite the return address on the stack?

From Dev

How to find whether a given address is in heap or in stack

From Dev

Clear stack frame on return (C)

From Dev

How to push and pop from a stack in Assembly mips?

From Dev

How to modify the Linux network stack with a loadable module?

From Dev

How do I obtain the return address from the stack pointer in C?

From Dev

Whats the thread return address on the stack?

From Dev

How to translate assembly to C with stack implemented on heap?

From Dev

Return address prediction stack buffer vs stack-stored return address?

From Dev

Simple stack example, how to return if stack is empty?

From Dev

Converting C to mips assembly, Unaligned address error

From Dev

How to modify return address on Stack in C or Assembly

From Dev

How to jump to an address saved in a register in intel assembly?

From Dev

How to modify web address in localhost using wamp?

From Dev

How to modify a class implementation in a .NET assembly?

From Dev

(reversing)return to specified location in c , assembly

From Dev

Proper convention for handling the stack when managing parameters and the return address

From Dev

s/360 assembly: how to implement a call stack

From Dev

How to modify the return address in Python 2 (or achieve an equivalent result)

Related Related

  1. 1

    Return address prediction stack buffer vs stack-stored return address?

  2. 2

    C - modify the address of a pointer passed to a function

  3. 3

    How does assembly know where to return?

  4. 4

    How assembly accesses/stores variables on the stack

  5. 5

    How to get stack memory address of a string in visual studio 2010 C#

  6. 6

    Missing return address on stack

  7. 7

    Simple stack example, how to return if stack is empty?

  8. 8

    Modify the return address of a C function with buffer overflow vulnerability

  9. 9

    How to return the last element in stack

  10. 10

    GCC C and ARM Assembly Stack Cleanup

  11. 11

    What happens if i overwrite the return address on the stack?

  12. 12

    How to find whether a given address is in heap or in stack

  13. 13

    Clear stack frame on return (C)

  14. 14

    How to push and pop from a stack in Assembly mips?

  15. 15

    How to modify the Linux network stack with a loadable module?

  16. 16

    How do I obtain the return address from the stack pointer in C?

  17. 17

    Whats the thread return address on the stack?

  18. 18

    How to translate assembly to C with stack implemented on heap?

  19. 19

    Return address prediction stack buffer vs stack-stored return address?

  20. 20

    Simple stack example, how to return if stack is empty?

  21. 21

    Converting C to mips assembly, Unaligned address error

  22. 22

    How to modify return address on Stack in C or Assembly

  23. 23

    How to jump to an address saved in a register in intel assembly?

  24. 24

    How to modify web address in localhost using wamp?

  25. 25

    How to modify a class implementation in a .NET assembly?

  26. 26

    (reversing)return to specified location in c , assembly

  27. 27

    Proper convention for handling the stack when managing parameters and the return address

  28. 28

    s/360 assembly: how to implement a call stack

  29. 29

    How to modify the return address in Python 2 (or achieve an equivalent result)

HotTag

Archive