Assuming stack as follows where the address of the string /bin/sh is 0x11:
after movl %esi, 0x8(%esi)
I think the value loaded form memory address %esi
will be moved to 0x8(%esi)
(that's the definition of movl
). So string /bin/sh
will be put at address 0x8(%esi)
. But the result is 11
is put at that address. In my opinion, if we want to put 11
at that address, we should use leal
instruction because leal
makes no dereference (just an address not the value).