I have a question,
I have a device that i can perform on it buffer overflow.
The problem is that is that there is an ASLR(on all addresses in /proc/binary/maps, but not on the binary itself, but all addresses in binary are starting with two null bytes for example 0x00002000) and there is as well as DEP(on heap an stack). I can override the return address(for the first gadget) but not possible to write additional addresses for ROP since all addresses from the binary starts with null bytes. I also can`t leak an address and it is not possible to perform brute force in order to guess addresses for example from libc. Does anyone have an idea how can perform the overflow in this case ?
\x01\x20\x00\x00
. If what you are overwriting already ends with two zeros, it may not matter that you can't send them. Although, this will only let you jump once, which may be enough depending on the stack/register setup (e.g. callsystem
).