0

I have code below:

void test_function(int a, int b, int c, int d) {
    int flag;
    char buffer[10];
    flag = 31337;
    buffer[0] = 'A';
}

int main() {
    test_function(1, 2, 3, 4);
}

I set breakpoints to the line where test_function is called with parameters and then to the test_function itself. After I run through both breakpoints I try to examine the stack frame using x/16xw $rsp.

0x7fffffffdd90: 0x00000004 0x00000003 0x00000002 0x00000001
0x7fffffffdda0: 0x00000002 0x00000000 0xbfebfbff 0x00000000
0x7fffffffddb0: 0xffffe259 0x00007fff 0x00000064 0x00000000
0x7fffffffddc0: 0xffffddd0 0x00007fff 0x555551b3 0x00005555

What seems very off is that the values of parameters are located in the lowest address in the stack. I thought they should be located in the highest. The output seems not to be following any logical order anyway, it seems split out quite randomly. I can find pieces of the disassembled code there, but in a complete random order. Also I cannot see the return address of main function.

I am following Hacking: Art Of Exploitation, where I think I understand it well, however I know it is for 32-bit, where I suppose is the problem. Can you please point me the right way to understand this on 64-bit? Thank you.

Employed Russian
  • 199,314
  • 34
  • 295
  • 362
JProSSV
  • 1
  • To properly understand this you probably want to take a look at the assembly code. – 500 - Internal Server Error Sep 25 '22 at 21:53
  • 1
    64-bit mode (more specifically, the Linux ABI) passes arguments in registers, so what you're seeing on the stack are the values copied by the code the compiler added to the beginning of the function, not the parameters themselves. When I disassemble the code, the 4th parameter is saved at the lowest address, which matches your output. As suggested above, disassembly will help understand it better. – sj95126 Sep 25 '22 at 22:01
  • Also see [Arguments in call stack above locals instead of below return address?](https://stackoverflow.com/q/70397045) for more links to other Q&As about the same mixup. – Peter Cordes Sep 27 '22 at 21:27

0 Answers0