相同的程序,每次运行时,栈都是从同一个地址开始的吗?

wilbur_cy

估计我没有说清楚..
是这样的  有下面一个程序
//sp.c

unsigned long find_sp(void){
  __asm__("movl %esp, %eax");
}
int main(int argc,char* argv[]){
char* buff;
int   len;
long sp;
len=atoi(argv[1]);
buff=malloc(len);
sp=find_sp();
printf("sp is 0x%x\n",sp);
free(buff);
exit(0);

}

然后我每次运行 ,输入相同的参数 我觉得打印结果应该是一样的吧   然而输出的结果每次都不同

比如
./sp 300

请问是怎么回事呢

谢谢大家

朱熹之

在linux中，栈的起始地址是动态变化的，与当前运行的程序和栈的情况有关

langue

楼主：请问您用 2.6 版本的内核吗？谢谢。

wilbur_cy

我是看了这段话时 发现的  我用linux时间不长 最近在学溢出   看的很晕

原文如下:

One of the most difficult tasks you face when trying to execute user-supplied shellcode is identifying the starting address of your shellcode. Over the years, many different methods have been contrived to solve this problem. We will cover the most popular method that was pioneered in the paper, "Smashing the Stack."

One way to discover the address of our shellcode is to guess where the shellcode is in memory. We can make a pretty educated guess, because we know that for every program, the stack begins with the same address. If we know what this address is, we can attempt to guess how far from this starting address our shellcode is.

It is fairly easy to write a simple program to tell us the location of the stack pointer (ESP). Once we know the address of ESP, we simply need to guess the distance, or offset, from this address. The offset will be the first instruction in our shellcode.






我的是red hat 9
Kernel 2.4.20-8

tyc611

原帖由 朱熹之 于 2007-1-13 23:21 发表
在linux中，栈的起始地址是动态变化的，与当前运行的程序和栈的情况有关

恩，这些信息都是动态的