thanx for replaying,
i did read "smashing the stack" many times, but there are differencies between what is written and what really happens due to change in kernel and GCC.
for example when u run the examples in "smashing the stack " ,the return address'
wont work because due to change in kernal and gcc there are additional 8 bytes after the frame pointer (after gcc 1.96 i think ) ....etc.
what i need to understand now is why when i point the ret address to the end of stack
it works? (i.e in the stack dump above jump to byte #66)
thanx for ur help