Writing over the return address

write-ret.c

#include <stdio.h>

void func(){
	int *ret;	// a local var in stack frame
	ret = &ret+2;	// +1 for the int* and +1 for saved ebp
	*ret += 12;	// ret addr += 12 (get from disassembly)
}

int main(int argc, char *argv[]) {
	func();
	printf("skip this\n");
	printf("return  here\n");
	return 0;
}