有人能看懂这段代码吗，他是怎么改变esp的 坐等大牛

Question

 #include "stdio.h"
#include "conio.h"
#include "windows.h"

char Msg[] = "Hello C++! I Love you forever!";

int __stdcall RelocThread(int Param)
{
    int Addr = 0;
    char *pMsg = NULL;
    if (!Param)
    {
        Addr = ((int(__stdcall*)(void))RelocThread)();
        Addr = 5 + Addr + *(int*)(Addr + 1);
        pMsg = (char*)(Addr + (int)&Msg - (int)&RelocThread);

        printf("In RelocThread:\n");
        printf("I can Found My start address myself=0x%08X\nand Global Value Msg=0x%X\n", Addr, pMsg);
        printf("%s\n", pMsg);

        ExitThread(0);
    }
    return (*(int*)((int)&Param - 4)) - 5;
}

void main(void)
{
    HANDLE hThread = CreateRemoteThread(GetCurrentProcess(), NULL, 0, (LPTHREAD_START_ROUTINE)RelocThread, 0, 0, NULL);
    WaitForSingleObject(hThread, INFINITE);
    printf("In function main:\nRelocThread=0x%08X,Msg=0x%08X\n", RelocThread, Msg);
    getch();
}

他是怎么改变esp的

Answer 1

堆栈上有函数的返回地址，通过故意越界的地址强行改写，当函数清栈退出的时候，就自动会将esp设置为这个返回地址（已经被改写）