admin/mgeeky-ThreadStackSpoofer
1
0
Fork 0
mirror of https://github.com/mgeeky/ThreadStackSpoofer synced 2026-06-06 16:14:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

readme

Browse Source
This commit is contained in:
Mariusz B. / mgeeky
2021-09-27 12:39:09 +02:00
parent a857e29a4a
commit 7210a25ec8
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1
View File
@@ -39,6 +39,7 @@ The rough algorithm is following:
Function return addresses are scattered all around the thread's stack memory area, pointed to by `RBP/EBP` register. In order to find them on the stack, we need to firstly collect frame pointers, then dereference them for overwriting:
![stack frame](images/frame0.png)
(the above image was borrowed from _Eli Bendersky's_ post named [Stack frame layout on x86-64](https://eli.thegreenplace.net/2011/09/06/stack-frame-layout-on-x86-64/))
```