title: Address of local variable on stack
body: <p>I wrote a little C code, opened it in GDB, put a breakpoint on line <code>exploit = (long long *)&amp;exploit+2;</code> and run the program.</p>
  
  <pre><code>#include&lt;stdio.h&gt;
  
  char Shellcode[] = "\x48\xc7\xc0\x01\x00\x00\x00"
                     "\x48\xc7\xc3\x1a\x00\x00\x00"
                     "\xcd\x80";
  
  int main()
  {
          long long *exploit;
          exploit = (long long *)&amp;exploit+2;
          *exploit = (long long)Shellcode;
          return 0;
  }
  </code></pre>
  
  <p>Since the breakpoint is set on line <code>exploit = (long long *)&amp;exploit+2;</code>, GDB stops the execution of program before executing that line and it'd mean that only the line <code>long long *exploit;</code>, which brings <code>exploit</code> into existence has been executed.</p>
  
  <p>At this point I was expecting <code>exploit</code> to reside on the top of the stack because it's the only local variable and local variables stay on the top of stack after calling a function(Please correct me if I'm wrong). Turns out it's not the case.</p>
  
  <pre><code>(gdb) print /x &amp;exploit 
  $2 = 0x7fffffffdfe8
  (gdb) x/6xg $rsp
  0x7fffffffdff0: 0x0000555555554690      0x00007ffff7a5a2b1
  0x7fffffffe000: 0x0000000000040000      0x00007fffffffe0d8
  0x7fffffffe010: 0x00000001f7b9b288      0x0000555555554660
  </code></pre>
  
  <p>As we can see that the top of the element is <code>0x7fffffffdff0</code> while the address of exploit is 8 bytes above the stack pointer(Above? How could it be?) at <code>0x7fffffffdfe8</code>. Can someone explain it to me?</p>
  
  <p><strong>Edit:</strong></p>
  
  <p>disassembling the main function gives:</p>
  
  <pre><code>0x555555554660 &lt;main&gt;           push   %rbp                                                                                                                         │
     │0x555555554661 &lt;main+1&gt;         mov    %rsp,%rbp                                                                                                                    │
  B+&gt;│0x555555554664 &lt;main+4&gt;         lea    -0x8(%rbp),%rax                                                                                                              │
     │0x555555554668 &lt;main+8&gt;         add    $0x10,%rax                                                                                                                   │
     │0x55555555466c &lt;main+12&gt;        mov    %rax,-0x8(%rbp)                                                                                                              │
     │0x555555554670 &lt;main+16&gt;        mov    -0x8(%rbp),%rax                                                                                                              │
     │0x555555554674 &lt;main+20&gt;        lea    0x2009b5(%rip),%rdx        # 0x555555755030 &lt;Shellcode&gt;                                                                      │
     │0x55555555467b &lt;main+27&gt;        mov    %rdx,(%rax)                                                                                                                  │
     │0x55555555467e &lt;main+30&gt;        mov    $0x0,%eax                                                                                                                    │
     │0x555555554683 &lt;main+35&gt;        pop    %rbp                                                                                                                         │
     │0x555555554684 &lt;main+36&gt;        retq
  </code></pre>
  
  <p><strong>Edit-2: What does this code do?</strong></p>
  
  <p>If the variable <code>exploit</code> resides at the top of stack(as I predicted it to be), the next 8 bytes below <code>exploit</code> would be RBP followed by the return address of an instruction in __libc_start_main() function(The function that sets up environment for execution of program, calls main(), and then cleans up the mess after execution).</p>
  
  <p><code>exploit = (long long *)&amp;exploit+2;</code> would shift and make the exploit to point the return address I mentioned and <code>*exploit = (long long)Shellcode;</code> would overwrite the return address with the address of <code>Shellcode</code>. Since the <code>Shellcode</code> is opcodes of pre-examined instructions and is readable by the processor, it'd be executed once the program finishes executing and tries to get back to __libc_start_main() using the return address, provided that the DEP is turned off.</p>