22 lines
887 B
Plaintext
22 lines
887 B
Plaintext
ReturnTable:
|
|
dw foo-1 ;each is a label to a section of code that ends in an RTS
|
|
dw bar-1
|
|
dw baz-1
|
|
|
|
ReturnSpoof: ;assume execution arrived here via a JSR command.
|
|
lda indexVariable ;contains the desired index into ReturnTable. 0 = foo, 1 = bar, 2 = baz.
|
|
asl ;the data is word length so the index must be multiplied by 2.
|
|
tax
|
|
|
|
lda ReturnTable+1,x ;get the high byte of the return address.
|
|
pha
|
|
lda ReturnTable,x ;get the low byte
|
|
pha
|
|
|
|
; Now, the desired subroutine's address minus 1 is on top of the stack.
|
|
; The RTS command will take this address and jump there. That routine's RTS command will act as the RTS from "ReturnSpoof",
|
|
; bringing execution to the point just after ReturnSpoof was called.
|
|
; If done properly, return spoofing will not corrupt the stack.
|
|
|
|
RTS ;this "RTS" acts as a JMP to the address we just put on the stack.
|