Exploiting Techniques \000 - ret2libc

[dtm]

@IoTh1nkN0t

x86’s call instruction actually does two things:

Push eip on stack

Either I’ve become super rusty at assembly or the address of the instruction after the call is pushed onto the stack.