#include <string.h>

int main(int argc,char *argv[]){
char buffer[5]; //缓冲区大小为5
strcpy(buffer,argv[1]); //发生缓冲区溢出的语句
return 0;
}

[admin@bogon ctf_stack]$ gdb -q ./vuln
Reading symbols from ./vuln...done.
(gdb) r `perl -e 'print "A"x24'`
Starting program: /home/songkun/ctf_stack/vuln `perl -e 'print "A"x24'`

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7a3b500 in __libc_start_main (main=0x400536 <main>, argc=2, argv=0x7fffffffe3a8, init=0x4141414141414141,
    fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe398) at libc-start.c:245
245         (*init) (argc, argv, __environ MAIN_AUXVEC_PARAM);
(gdb) i r rip
rip            0x7ffff7a3b500   0x7ffff7a3b500 <__libc_start_main+112>
(gdb) x/i 0x7ffff7a3b500
=> 0x7ffff7a3b500 <__libc_start_main+112>:      add    %cl,-0x75(%rax)

(gdb)i r rax

rax            0x0      0
(gdb) disass
Dump of assembler code for function __libc_start_main:
   0x00007ffff7a3b490 <+0>:     push   %r14
   0x00007ffff7a3b492 <+2>:     push   %r13
   0x00007ffff7a3b494 <+4>:     push   %r12
   0x00007ffff7a3b496 <+6>:     push   %rbp
   0x00007ffff7a3b497 <+7>:     mov    %rcx,%rbp
   0x00007ffff7a3b49a <+10>:    push   %rbx
   0x00007ffff7a3b49b <+11>:    sub    $0x90,%rsp
   0x00007ffff7a3b4a2 <+18>:    mov    0x39a90f(%rip),%rax        # 0x7ffff7dd5db8
   0x00007ffff7a3b4a9 <+25>:    mov    %rdi,0x18(%rsp)
   0x00007ffff7a3b4ae <+30>:    mov    %esi,0x14(%rsp)
   0x00007ffff7a3b4b2 <+34>:    mov    %rdx,0x8(%rsp)
   0x00007ffff7a3b4b7 <+39>:    test   %rax,%rax
   0x00007ffff7a3b4ba <+42>:    je     0x7ffff7a3b587 <__libc_start_main+247>
   0x00007ffff7a3b4c0 <+48>:    mov    (%rax),%eax
   0x00007ffff7a3b4c2 <+50>:    xor    %edx,%edx
   0x00007ffff7a3b4c4 <+52>:    test   %eax,%eax
   0x00007ffff7a3b4c6 <+54>:    sete   %dl
   0x00007ffff7a3b4c9 <+57>:    lea    0x39abd0(%rip),%rax        # 0x7ffff7dd60a0 <__libc_multiple_libcs>
   0x00007ffff7a3b4d0 <+64>:    test   %r9,%r9
   0x00007ffff7a3b4d3 <+67>:    mov    %edx,(%rax)
   0x00007ffff7a3b4d5 <+69>:    je     0x7ffff7a3b4e3 <__libc_start_main+83>
   0x00007ffff7a3b4d7 <+71>:    xor    %edx,%edx
   0x00007ffff7a3b4d9 <+73>:    xor    %esi,%esi
   0x00007ffff7a3b4db <+75>:    mov    %r9,%rdi
   0x00007ffff7a3b4de <+78>:    callq  0x7ffff7a54850 <__GI___cxa_atexit>
   0x00007ffff7a3b4e3 <+83>:    mov    0x39a976(%rip),%rdx        # 0x7ffff7dd5e60
   0x00007ffff7a3b4ea <+90>:    mov    (%rdx),%ebx
   0x00007ffff7a3b4ec <+92>:    and    $0x2,%ebx
   0x00007ffff7a3b4ef <+95>:    jne    0x7ffff7a3b5c6 <__libc_start_main+310>
   0x00007ffff7a3b4f5 <+101>:   test   %rbp,%rbp
   0x00007ffff7a3b4f8 <+104>:   je     0x7ffff7a3b50f <__libc_start_main+127>
---Type <return> to continue, or q <return> to quit---
   0x00007ffff7a3b4fa <+106>:   mov    0x39a9a7(%rip),%rax        # 0x7ffff7dd5ea8//未找到偏移为112的指令
   0x00007ffff7a3b501 <+113>:   mov    0x8(%rsp),%rsi