Overwrite the Return Address on the Stack

Controlling Execution via Return Address Overwrite

By overflowing a buffer on the stack, an attacker can overwrite the saved return address of the current function. When the function returns, the CPU pops this corrupted address into RIP, diverting execution to an attacker-chosen location.

Offset Calculation

The key step is finding the exact byte offset from the buffer start to the return address:

• Distance = buffer size + saved frame pointer size (8 bytes on x64)
• For example, char buf[16] gives offset = 16 + 8 = 24 bytes to the return address
• The next 8 bytes overwrite RIP with the new target address

Tools like pwntools' cyclic() and GDB's pattern_create automate finding this offset by generating unique byte sequences.

For This Exercise

You will calculate and document the exact offset to the return address and simulate overwriting it with a controlled value. This offset-calculation technique is what CTF players and pentesters use to hijack RIP in real vulnerability exploitation.

From Offset to Exploit

After finding the offset, you place a target address at exactly that byte position. In a real exploit, the address might point to shellcode (pre-NX), a ROP gadget (post-NX), or a win() function in a CTF binary. GDB's x/20gx $rsp shows the stack layout live, confirming your offset calculation before you build the final payload with a tool like pwntools.