/* 

	replacement example for example3.c in aleph1's classic
	"Smashing the stack for fun and profit"

	Reason:
		1) New compilers refuse to work with the previous example.
		2) The previous example had incremented the wrong amount.
*/


void func(int a, int b, int c)
{
	char *ret;
	int i;

	/* 
		Let's have a view of what is on the stack... 
		Starting from *ret and upwards..
	*/

	for (i = 0; i < 16; i++, ret += 4) {
		ret = (char *) &ret + i * sizeof(int);
		printf("0x%x\n", *(int *) ret);
	}

	// we first find EIP on the stack by using our parameter 'int a'
	// instead because this is (nearly) compiler independent.
	ret = (char *) &a - 4;

	// we change it by incrementing 10, which is the length of
	// add (3 bytes) + mov (7 bytes)

	// aleph1 forgot the 'add' opcode even though it was
	// in his debug output. It is by pure luck that it worked with
	// 8 as the last two bytes inside the 'mov' opcode did nothing
	// on most systems.
	// e.g. "add %al, (%eax)"

	*(int *) ret += 10;
}

int main()
{
	int x;

	x = 0;
	func(1, 2, 3);
	x = 1;
	printf("-----\n");
	printf("%d\n", x);
}