Apparently, this code attempts to change the stack so that when the
main function returns, program execution does not return regularly into the runtime library (which would normally terminate the program), but would jump instead into the code saved in the
defines a variable on the stack, just beneath the
main function's arguments.
ret = (int *)&ret + 2;
ret variable point to a
int * that is placed two
ret on the stack. Supposedly that's where the return address is located where the program will continue when
(*ret) = (int)shellcode;
The return address is set to the address of the
shellcode array's contents, so that
shellcode's contents will be executed when
shellcode seemingly contains machine instructions that possibly do a system call to launch
/bin/sh. I could be wrong on this as I didn't actually disassemble
P.S.: This code is machine- and compiler-dependent and will possibly not work on all platforms.
Reply to your second question:
and what happens if I use
ret=(int)&ret +2 and why did we add 2?
why not 3 or 4??? and I think that int
is 4 bytes so 2 will be 8bytes no?
ret is declared as an
int*, therefore assigning an
int (such as
(int)&ret) to it would be an error. As to why 2 is added and not any other number: apparently because this code assumes that the return address will lie at that location on the stack. Consider the following:
This code assumes that the call stack grows downward when something is pushed on it (as it indeed does e.g. with Intel processors). That is the reason why a number is added and not subtracted: the return address lies at a higher memory address than automatic (local) variables (such as
From what I remember from my Intel assembly days, a C function is often called like this: First, all arguments are pushed onto the stack in reverse order (right to left). Then, the function is called. The return address is thus pushed on the stack. Then, a new stack frame is set up, which includes pushing the
ebp register onto the stack. Then, local variables are set up on the stack beneath all that has been pushed onto it up to this point.
Now I assume the following stack layout for your program:
| function arguments | |
| (e.g. argv, argc) | | (note: the stack
+-------------------------+ <-- ss:esp + 12 | grows downward!)
| return address | |
+-------------------------+ <-- ss:esp + 8 V
| saved ebp register |
+-------------------------+ <-- ss:esp + 4 / ss:ebp - 0 (see code below)
| local variable (ret) |
+-------------------------+ <-- ss:esp + 0 / ss:ebp - 4
At the bottom lies
ret (which is a 32-bit integer). Above it is the saved
ebp register (which is also 32 bits wide). Above that is the 32-bit return address. (Above that would be
main's arguments --
argv -- but these aren't important here.) When the function executes, the stack pointer points at
ret. The return address lies 64 bits "above"
ret, which corresponds to the
+ 2 in
ret = (int*)&ret + 2;
+ 2 because
ret is a
int*, and an
int is 32 bit, therefore adding 2 means setting it to a memory location 2 × 32 bits (=64 bits) above
(int*)&ret... which would be the return address' location, if all the assumptions in the above paragraph are correct.
Excursion: Let me demonstrate in Intel assembly language how a C function might be called (if I remember correctly -- I'm no guru on this topic so I might be wrong):
// first, push all function arguments on the stack in reverse order:
// then, call the function; this will push the current execution address
// on the stack so that a return instruction can get back here:
// (afterwards: clean up stack by removing the function arguments, e.g.:)
add esp, 8
Inside main, the following might happen:
// create a new stack frame and make room for local variables:
mov ebp, esp
sub esp, 4
// access return address:
mov edi, ss:[ebp+4]
// access argument 'argc'
mov eax, ss:[ebp+8]
// access argument 'argv'
mov ebx, ss:[ebp+12]
// access local variable 'ret'
mov edx, ss:[ebp-4]
// restore stack frame and return to caller (by popping the return address)
mov esp, ebp
See also: Description of the procedure call sequence in C for another explanation of this topic.