ciscn

ciscn

栈转移

不重复造轮子！！！

推荐链接，结合着看，认真看完基本上就懂了！

https://bbs.pediy.com/thread-258030.htm

https://bbs.pediy.com/thread-269163.htm

https://blog.csdn.net/mcmuyanga/article/details/109318321

https://www.freebuf.com/articles/system/305341.html

注意：system函数传进去的是/bin/sh的地址，/bin/sh写到栈里面去了，借用ebp算s的位置，继而算出偏移值！

理解起来有难度，柳暗花明又一村！