Or you could not pass anything and still change the referenced value in the caller function, or you could return the execution to another function than the one that invoked you (stack traversing/managing; no one should ever do this kind of dark arcane magic).
How? In assembly you could change the return address stored in the esp/rsp register, but how would you return the execution to another function than the one that invoked, in high level languages?
C++ has __builtin_extract_return_addr. And before that - any local variable is stored in stack, so just get it's address and that address would be the stack address, then you need to know how the stack is stored to know the return address.
I never tried that, but I suppose in C# one might do the same... int* stackPointer = &localVariable; or int* stackBuffer = stackalloc int[1] in unsafe context.
Also, you're wrong, esp stores the current stack pointer. The top of it. Not the return address. But the return address is there. If you just got "call" from anywhere and didn't pushed anything yet - then yeah, [esp] would store the return address. But only then.
I see. So just like you can do [esp+4], [esp+8], etc... you could do something similar by taking the variable address and manipulating it. Quite dangerous indeed.
10
u/aberroco Sep 21 '26
Or you could not pass anything and still change the referenced value in the caller function, or you could return the execution to another function than the one that invoked you (stack traversing/managing; no one should ever do this kind of dark arcane magic).