trying to buffer overflow simple c program

i'm having problem to buffer overflow a simple c program that takes input from command line, this is the main.c code:

#include <stdio.h>
#include <string.h>
void func(char *name)
{
   char buf[10];
   strcpy(buf, name);
}
void chgflow(){
     printf("changed flow!!\n");
}
void main(int argc, char *argv[])
{
  func(argv[1]);
  printf("i should not be viewed if flow is changed\n");
  chgflow();
} 

this is the assembly version taken from objdump -d ./main :

<main>:
 5a3:   8d 4c 24 04             lea    0x4(%esp),%ecx
 5a7:   83 e4 f0                and    $0xfffffff0,%esp
 5aa:   ff 71 fc                pushl  -0x4(%ecx)
 5ad:   55                      push   %ebp
 5ae:   89 e5                   mov    %esp,%ebp
 5b0:   53                      push   %ebx
 5b1:   51                      push   %ecx
 5b2:   e8 99 fe ff ff          call   450 <__x86.get_pc_thunk.bx>
 5b7:   81 c3 49 1a 00 00       add    $0x1a49,%ebx
 5bd:   89 c8                   mov    %ecx,%eax
 5bf:   8b 40 04                mov    0x4(%eax),%eax
 5c2:   83 c0 04                add    $0x4,%eax
 5c5:   8b 00                   mov    (%eax),%eax
 5c7:   83 ec 0c                sub    $0xc,%esp
 5ca:   50                      push   %eax
 5cb:   e8 7d ff ff ff          call   54d <func>
 5d0:   83 c4 10                add    $0x10,%esp
 5d3:   83 ec 0c                sub    $0xc,%esp
 5d6:   8d 83 90 e6 ff ff       lea    -0x1970(%ebx),%eax
 5dc:   50                      push   %eax
 5dd:   e8 fe fd ff ff          call   3e0 <puts@plt>
 5e2:   83 c4 10                add    $0x10,%esp
 5e5:   e8 8e ff ff ff          call   578 <chgflow>
 5ea:   90                      nop
 5eb:   8d 65 f8                lea    -0x8(%ebp),%esp
 5ee:   59                      pop    %ecx
 5ef:   5b                      pop    %ebx
 5f0:   5d                      pop    %ebp
 5f1:   8d 61 fc                lea    -0x4(%ecx),%esp
 5f4:   c3                      ret

<func>:
 54d:   55                      push   %ebp
 54e:   89 e5                   mov    %esp,%ebp
 550:   53                      push   %ebx
 551:   83 ec 14                sub    $0x14,%esp
 554:   e8 9c 00 00 00          call   5f5 <__x86.get_pc_thunk.ax>
 559:   05 a7 1a 00 00          add    $0x1aa7,%eax
 55e:   83 ec 08                sub    $0x8,%esp
 561:   ff 75 08                pushl  0x8(%ebp)
 564:   8d 55 ee                lea    -0x12(%ebp),%edx
 567:   52                      push   %edx
 568:   89 c3                   mov    %eax,%ebx
 56a:   e8 61 fe ff ff          call   3d0 <strcpy@plt>
 56f:   83 c4 10                add    $0x10,%esp
 572:   90                      nop
 573:   8b 5d fc                mov    -0x4(%ebp),%ebx
 576:   c9                      leave
 577:   c3                      ret

<chgflow>:
 578:   55                      push   %ebp
 579:   89 e5                   mov    %esp,%ebp
 57b:   53                      push   %ebx
 57c:   83 ec 04                sub    $0x4,%esp
 57f:   e8 71 00 00 00          call   5f5 <__x86.get_pc_thunk.ax>
 584:   05 7c 1a 00 00          add    $0x1a7c,%eax
 589:   83 ec 0c                sub    $0xc,%esp
 58c:   8d 90 80 e6 ff ff       lea    -0x1980(%eax),%edx
 592:   52                      push   %edx
 593:   89 c3                   mov    %eax,%ebx
 595:   e8 46 fe ff ff          call   3e0 <puts@plt>
 59a:   83 c4 10                add    $0x10,%esp
 59d:   90                      nop
 59e:   8b 5d fc                mov    -0x4(%ebp),%ebx
 5a1:   c9                      leave
 5a2:   c3                      ret

first of all i executed:

echo 0 > /proc/sys/kernel/randomize_va_space

then compiled main.c :

gcc -m32 -g main.c -o main -fno-stack-protector

when func function terminates i want to overwrite the regular ret address, and pointing to chgflow function, therefore bypassing the regular next instruction:

printf("i should not be viewed if flow is changed\n");

to debug the main.c and inspect which memory addresses are in place i executed:

gdb ./main
go
disas main
disas chgflow

and this is what i found for disas main:

0x565555cb <+40>:    call   0x5655554d <func>
0x565555d0 <+45>:    add    $0x10,%esp

and for chgflow:

Dump of assembler code for function chgflow:
0x56555578 <+0>:     push   %ebp

So i can understand that:

0x565555d0 <+45>:    add    $0x10,%esp

is the regular ret address (and next instruction) after func terminates, and 0x56555578 is the first instruction of chgflow function. Now i have to inspect assembly of func to understand how many char A (let's say) i need for stuffing the stack; from this line:

564:   8d 55 ee                lea    -0x12(%ebp),%edx

i understand i need 18Byte + 4 Byte of A stuffing to get to Ret address. To confirm this i executed again:

gdb ./main
break 7
run AAAAAAAAAAAAAAAAAAAAAA

("A" repeated 22 times)

(gdb) x/s $ebp-18
0xffffd2a6: 'A' <repeats 22 times>
(gdb) x/s $ebp
0xffffd2b8: "AAAA"
(gdb) x/x $ebp+4
0xffffd2bc: 0x00

my test finished here because i cannot understand why (gdb) x/x $ebp+4 that should be the Ret address, displays 0x00 as the result. I expected the ret address to not change from the regular one 0x565555d0. But, hey! 0x00 should be the terminator isn't it? So i went on and performed another test with 21 "A" stuffing and the result is correct this time:

(gdb) x/x $ebp+4
0xffffd2bc: 0x565555d0

My last need is now to overwrite the return address with 0x56555578, that is the address of the first instruction of chgflow function. I performed the previous test with this replaced:

run AAAAAAAAAAAAAAAAAAAAA\x78\x55\x55\x56

("A" repeats 21 times) but gdb gave to me:

Breakpoint 1, func (name=0x35357835 ) at main.c:7

and this is what i can see from memory:

(gdb) x/x $ebp+4
0xffffd2ac: 0x37
(gdb) x/s $ebp+4
0xffffd2ac: "78x55x55x56"

finally i was not able to jump to chgflow

Anyone can help me with this? i'd really appreciate. regards Marco