#include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 void func(int key){
     char overflowme[32];
     printf("overflow me : ");
     gets(overflowme);   // smash me!
     if(key == 0xcafebabe){
         system("/bin/sh");
     }
     else{
         printf("Nah..\\n");
     }
 }
 int main(int argc, char* argv[]){
     func(0xdeadbeef);
     return 0;
 }

The strategy here is easy, overwite the char overflowme with 32 bytes. and then put 0xcafebabe to replace the key value.

Key Point: because the gets will not validate how many bytes we put in there. So it will keep writing to the stack until it receives a terminator byte. and it gives us the chance to overwrite the entire stack.

here is the stack flow.

1. Initialize the stack frame.

2. push parameter 0xdeadbeef onto the stack.

   

3. and then enter func prolog.

4. now we go to where the 0xcafebabe is being cmp. Proves of that now

5. the value stored at $EBP+8 is being compared

Game plan: change 0xdeadbeef to 0xcafebabe .

well, here is my way of approaching this.

I simply dump all the data between gets to the $EBP + 8 . so we can calculate how many bytes we need to write to overwrite the [$EBP + 8].

1. Set a break point at *0x56555654
2. Input some random A into the overflowme .

3. And we have got it somewhere