Locals, Saved RBP, Saved Return Address
- Local buffers live at the low end of the frame (near
RSP). - Above them: the saved RBP (pushed by the prologue).
- Above that: the saved return address, placed there by the
callinstruction in the caller. - Writing more bytes into a buffer than it can hold (a classic buffer overflow) marches upward and clobbers these control values.
Key Takeaway
The saved return address is the single most valuable target in a stack overflow: overwrite it and ret jumps wherever you point it.