#include #include #include const char *stack_dump = "%18p %18p %18p %18p\n%18p %18p %18p %18p\n%18p %18p %18p %18p\n%18p %18p %18p %18p\n%18p %18p %18p %18p\n"; char big_buf[6] = {'\0'}; void call_me() { system("/bin/sh"); } int secure_function() { uint64_t special_value = 0x4141414141414141; puts("Here's the stack:"); printf(stack_dump); printf("Hi! Give me a number so that I can put it at %p.\n", &special_value); scanf("%lx", &special_value); puts("OK, now give me a scanf string, but please don't exploit me! (max 5 characters)"); scanf("%5s", big_buf); puts("OK, now I'll call scanf with your string and special_value as the only parameter."); scanf(big_buf, &special_value); puts("OK, all done."); return special_value; } int main() { printf("You entered: %x\n", secure_function()); return 0; }