readme

2026-06-06 16:14:32 +00:00 · 2021-09-27 12:33:02 +02:00
parent eb0894490b
commit 7ec391c6b0
1 changed files with 3 additions and 0 deletions
@@ -38,6 +38,9 @@ The rough algorithm is following:

 Function return addresses are scattered all around the thread's stack memory area, pointed to by `RBP/EBP` register. In order to find them on the stack, we need to firstly collect frame pointers, then dereference them for overwriting:

+[!stack frame](images/frame.png)
+(the above image was borrowed from _Eli Bendersky's_ post named [Stack frame layout on x86-64](https://eli.thegreenplace.net/2011/09/06/stack-frame-layout-on-x86-64/))
+
 ```
 	*(PULONG_PTR)(frameAddr + sizeof(void*)) = Fake_Return_Address;
 ```