A Primer on Buffer Overflows: Overwriting the Return Address

Buffer overflow remains a classic binary exploit vector. It occurs when a program writes more data to a buffer on the stack than the buffer is allocated to hold.

Stack Layout & EIP Control

The stack grows downward in memory. When a function is called, the compiler pushes local variables, the Saved Frame Pointer (EBP), and the Return Address (EIP) onto the stack.

If input is copied into a buffer using an unsafe function (like strcpy or gets) without bounds checking:

1. The buffer is filled.
2. The Saved Frame Pointer is overwritten.
3. The Return Address (EIP) is overwritten.

Exploitation Concept

[ Buffer (64 bytes) ] [ Saved EBP (4 bytes) ] [ Return Address (4 bytes) ]
<-------------------- Attacker Input Overwrite -------------------->

By overwriting the return address with the address of shellcode or a system function, the attacker hijacks the execution flow as soon as the function returns.