Within the file bufbomb, there is a function
fizz having the following C code:
void fizz(int val)
{
if (val == cookie) {
printf("Fizz!: You called fizz(0x%x)\n", val);
validate(1);
} else
printf("Misfire: You called fizz(0x%x)\n", val);
exit(0);
}
Similar to Level 0, your task is to get bufbomb to execute
the code for fizz when getbuf executes its
return statement, rather than returning to test. In this
case, however, you must make it appear to fizz as if you
have passed your cookie as its argument. You can do this by encoding
your cookie in the appropriate place within your exploit string.
Some Advice:
fizz —
it will simply execute its code. This has important implications
for where on the stack you want to place your cookie.