使用这个函数来模拟数组越界：

void buf_overflow(int n, char val)
{
    volatile char buf[5];
    volatile int a = 0x55;
    buf[0] = 0x5a;
    a++;
    buf[n] = val;
    myput_s_hex("buf[0] = ", buf[0]);
    myputs("\n");
    myput_s_hex("a is ", a);
    myputs("\n");
}

破坏其它变量

main 函数中调用：

buf_overflow(8, 'A');

    i.buf_overflow
    buf_overflow
        0x08001e3c:    b50e        ..      PUSH     {r1-r3,lr}   ; 只是为了分配空间，跟r1-3里面的值无关
        0x08001e3e:    225a        Z"      MOVS     r2,#0x5a
        0x08001e40:    f88d2000    ...     STRB     r2,[sp,#0]    ; 写入[0]
        0x08001e44:    2256        V"      MOVS     r2,#0x56
        0x08001e46:    9202        ..      STR      r2,[sp,#8]    ; 写入[8]
        0x08001e48:    f80d1000    ....    STRB     r1,[sp,r0]
        0x08001e4c:    f89d1000    ....    LDRB     r1,[sp,#0]
        0x08001e50:    a006        ..      ADR      r0,{pc}+0x1c ; 0x8001e6c
        0x08001e52:    f000f8df    ....    BL       myput_s_hex ; 0x8002014
        0x08001e56:    a008        ..      ADR      r0,{pc}+0x22 ; 0x8001e78
        0x08001e58:    f000f906    ....    BL       myputs ; 0x8002068
        0x08001e5c:    a007        ..      ADR      r0,{pc}+0x20 ; 0x8001e7c
        0x08001e5e:    9902        ..      LDR      r1,[sp,#8]
        0x08001e60:    f000f8d8    ....    BL       myput_s_hex ; 0x8002014
        0x08001e64:    a004        ..      ADR      r0,{pc}+0x14 ; 0x8001e78
        0x08001e66:    f000f8ff    ....    BL       myputs ; 0x8002068
        0x08001e6a:    bd0e        ..      POP      {r1-r3,pc}