From 7ec391c6b082619acb7ae85fe1ab9fc82f1fbfb5 Mon Sep 17 00:00:00 2001 From: "Mariusz B. / mgeeky" Date: Mon, 27 Sep 2021 12:33:02 +0200 Subject: [PATCH] readme --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index bcad563..89b734c 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,9 @@ The rough algorithm is following: Function return addresses are scattered all around the thread's stack memory area, pointed to by `RBP/EBP` register. In order to find them on the stack, we need to firstly collect frame pointers, then dereference them for overwriting: +[!stack frame](images/frame.png) +(the above image was borrowed from _Eli Bendersky's_ post named [Stack frame layout on x86-64](https://eli.thegreenplace.net/2011/09/06/stack-frame-layout-on-x86-64/)) + ``` *(PULONG_PTR)(frameAddr + sizeof(void*)) = Fake_Return_Address; ```